I don’t think they can charge for updates, at least not in the first five years where the EU mandates that updates must be made available.

Also if it's mandatory? I would also say it's desirable to prevent the situation in which users just choose to have zombie devices because security is more expensive, but making them free or making them mandatory paid would both work for that