Then we could begin forcing manufacturers to sell security updates regardless of the age of the device.
Lots of questions and puzzles here that would be interesting to figure out.
Who's going to pay for those updates? It's hard for the economics to work out. It makes sense for handset makers to pour engineering resources into developing and maintaining operating systems when there's millions of customers. How are you going to scrape together enough money when there's only a handful of customers?
But in the current ecosystem every device has its own medley of custom firmware and software that gets abandoned when the maker stops selling that version, and the makers are incentivized to stop updates to drive customers to buy new devices.
It is actually cheap and easy if we change the question: Should you be allowed to run a closed source proprietary platform with insufficient security? After all, if you open it up and let people do what they want it becomes their responsibility.
Bricking the device at a predetermined date isn't very elegant but it would work. Maybe the user should have the option to return it (working or not) and get some money back.
And then there is the other problem that an old enough phone is no longer getting software updates, including security updates either.
Yes, it is still probably less than buying a new phone but you don't know how long it will be before another component dies. If replacing the battery gives you another 4-5 years it might be worth it, but if something else is going to break in a couple months, probably not.