Those should shouldn't be affected by a myriad of security vulnerabilities that come up by then just because they are poor and because companies would rather have planned obsolescence. It's the digital divide between rich and poor. The rich get security if they buy a high-end phone every year (if we are to consider Android's average security update lifetime), and the poor do not.

True, but so is your software. Especially on Android where Play Services and the Chrome browser are updatable via the Play Store, being on the previous version of Android isn't such an issue any more.