That still doesn't excuse it at the least. Forcing manufactures to support security updates on these devices for a reasonable amount of time (no less than 6 years) would greatly slow planned obsolescence and may even force manufactures to actually agree on driver and kernel standards instead of their mess of non-upstreamable garbage patches.
Right now we're lucky to get even 2 years of normal updates (much less security updates) on any Android device.