The EU Cyber Resilience Act already requires updates for at least five years (or the life expectancy of the product) after the last unit was sold. So if they sell them for 5 years, they're barely keeping up with the law. On top of that, there are already voices pushing for mandatory 15 years of support.