This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.

On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.

Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.

The EU's CRA does mandate this kind of thing. It states 5 years minimum, but it needs to be longer if it's expected that the product remains in use for longer, and you need to commit to it in advance and tell customers (at the point of sale: so printed on the box or on the product listing).