As far as I understand price sensitive users will stop using apps that don't support their device instead of upgrading. (Or will try to roll back the update of said apps.) Providing base security updates wouldn't change this logic.
I'm not convinced. Apple controls the iPhone market and can do this, but no Android manufacturer controls the Android market. A brand that deliberately reduces its own devices' lifespan can't trust that its consumers will buy another device from the same brand. I think it's just a matter of not offering support being cheaper than some plan to reduced lifespan leading to new purchases.
This is the biggest reason Google is pushing for there being one version of the Android kernel, across all vendors: to make updates always possible.
Wrong, there's a big reason: Qualcomm. Newer Android releases often bump the minimum required version of the Linux kernel. If Qualcomm stops supporting a particular chipset, they won't give you new binary blobs (part of what's known as a "board support package" or BSP) for the new minimum kernel version, so you can't update.
Google managed to negotiate with Qualcomm to get them to support old chipsets for longer, but it still falls far short of what Apple does. And now Google is making their own chips for Pixel phones and are doing 5 years of security updates (though still only 3 for major OS updates, boo).
And really, it just boils down to a shitty planned-obsolescence business decision. Apple knows that they will have enough people to buy (either first-time or upgrade) their newest shiny iPhone come release time every year, even if they continue to support 8-year old phones. Google doesn't have that confidence, so they don't put as much effort into upgrades for older devices. And that's Google, who makes fairly high-end phones; the makers of low-end devices know their users are price-sensitive and won't upgrade phones unless they have to.
So it's really two things: one is that they don't want to, and there's no market or regulatory force that pushes them to. And the other is that they truly are limited in how far they can support upgrades, much more limited than Apple is, since Apple controls the entire hardware and software stack.
Having said all that, do understand that I don't endorse or like the current situation here. My Pixel 4 stopped getting security updates (technically last fall, but Google pushed out a roll-up update a few months ago), and I'm frankly not ready to upgrade. The hardware is fine, the software is snappy, and it does everything I want it to. The Pixel 7a is probably my next best bet, but it is yet again a physically larger phone, and I hate that. But this is the situation, and these are the reasons for it.