I'm thinking Apple may be the way to go this time, because they maintain security updates for older devices for longer. (Seems like 5+ years.)
Another way of looking at this is that lacking security updates create unnecessary electronic/chemical pollution/waste. I think the EU should tackle this. I'm sure they could come up with some scheme for penalties for lacking security updates. (Does anyone know of any initiative in this area?)