We should just force companies by law to provide software patches for anything that can connect to a network for at least five years, better ten, or be liable for security problems.
Google would need to make it a requirement for bundling their services. Since the major distributers are utterly dependent on Google/Android, they'd do it.
Making it a legal requirement would be challenging, but making it a de facto requirement for all major phone vendors is easy.