> Next the EU are going to have to address security patches because its another aspect being used to sell new phones.

They already are. 5 years of updates is now the legal minimum in the EU. https://www.osnews.com/story/142500/new-eu-rules-mandate-fiv...