OEMs could ship their own security patches. (They are already running frankenkernels. They have some in-house expertise for patching the kernel, making the image, etc.) They don't, because they don't want to spend money on it. (And probably a smaller factor is that they don't want to cannibalize the sales of their newer devices.)

As far as I understand price sensitive users will stop using apps that don't support their device instead of upgrading. (Or will try to roll back the update of said apps.) Providing base security updates wouldn't change this logic.