> after 3 years because the vendor stops giving security updates for its software? This should be illegal.

Feature updates stopped, security updates did not. The phones are still receiving monthly security patches and will continue to do so. Google did not stop those.