I think that a lot of people miss the point that most people don't care about updates. Most people want a phone that does the same thing when it was bought and as many years later as possible, as the battery allows.

It's the same thing around passwords. People don't use weak passwords or reuse their passwords because they don't know any better, they do it because they do not care about whatever is protected by the password. I personally couldn't care less if someone stole my Facebook or that some bad actor may abuse something in my phone to send something to China. These digital things rank very low on the list of my priorities, and like me are a lot of not very technical interested people.

Some people buy cheap phones knowing they won't get updates, we know, we don't care. And we are happy to have the option not to care, we do not want more expensive phone with constant updates, just like we don't want the mandatory use of password managers. If we cared we'd buy/use them.