I totally agree with your assessment. So does Fairphone. That's why we trying to address both issues with a modular design for ease of repairs and long lasting software updates.
Have a look at our current effort to bring continued software updates to our five year old predecessor Fairphone 2: https://www.fairphone.com/en/2020/06/18/fairphone-2-gets-and...
I suspect that the outdated downstream 3.4 kernel isn't even getting security fixes, so the QualPwn root takeover vulnerability (among many others) would be unpatched.
A big step in the right direction would be to work with Linaro, postmarketOS, and other parties actively involved in mainlining Qualcomm chipsets to forward-port the old SoC to a mainline kernel, or at least to a newer downstream Qualcomm kernel version. It's not trivial, but it's possible; I've ported my Pixel 2 XL with a Snapdragon 835 (kernel 4.4) to the 855's kernel version (4.14) with most features working. I never got around to finishing it and polishing it for daily use, but an actual company like Fairphone should have the resources to do so. In fact, there is already a WIP port of the FP2 to pmOS with a mainline kernel [2], and there's more mainlining work for it that has a decent amount of features working [3].
While this doesn't solve the firmware problems (which really can't be dealt with as even OEMs don't get a lot of the source code for the firmware), it still improves security (and performance!) by a lot since most severe vulnerabilities that users are most likely to be hit by are in the kernel. I think this is ultimately going to be the right way to go if Fairphone wants to keep updating devices for so long and patching as many security issues as possible.
Perhaps Fairphone could also negotiate a long-term support contract with Qualcomm? I noticed that the mid-range Snapdragon 660 that started on kernel 4.4 was officially forward-ported to kernel 4.14, probably due to some vendor requesting it.
Don't get me wrong: it's already much better than other manufacturers, and the BSP support problem is out of Fairphone's control, but it's still possible to make the best of the situation on the software side without relying on Qualcomm as much.
[1] https://blade.tencent.com/en/advisories/qualpwn/
[2] https://wiki.postmarketos.org/wiki/Fairphone_2_(fairphone-fp...
[3] https://wiki.postmarketos.org/wiki/Qualcomm_Snapdragon_800/8...
We did indeed talk to other interested parties and attempted forward ports of the Qualcomm specific kernel features to LTS versions. I am not directly involved in that team anymore and sadly cannot tell you the exact reasons, but this failed to yield a usable kernel.
I do like your suggestion of long-term support from Qualcomm which was unfortunately not possible for the Snapdragon 801. For Fairphone 3, this is hopefully on the table again (especially, if — as you are saying — other customers also show interest in LTS support).
In summary, you make many great suggestions most of which we also attempted at some point. Unfortunately, the devil is often in the details.