> A really simple step in the right direction would be mandated labeling showing how many years of software updates the device will get and statistical expected lifetime.

This isn't that simple because it depends on _which_ software. This gets glossed over a lot in these discussions.

An iPhone gets ~5 years of iOS updates. Importantly, these updates are the only place where the only permitted web viewer on the platform gets updated. An android phone gets 2-3 years, if it's very lucky, of android updates. However, the _browser_ you use on that device is updated entirely independently of the OS, and while it isn't obvious how far back Chrome supports, android Firefox runs on android 5.0 devices (i.e. at least 7 years, probably more?)

These are two different security scenarios - an iOS device is fully patched against OS-level exploits for longer. True. But an android device will have a safer browser for a lot longer. In my threat model the latter is a lot more important - I don't think I'm unusual in that my web browser is by far my largest attack surface.

(disclaimer: i work at google, but i work on iOS stuff and like iOS a lot. more than android for sure. but i'm very salty that i can't have a browser updated independently from the OS)