I’m open to considering the nuance here.
For a washing machine or refrigerator, I’d say twenty years is the minimum. For a phone or computer? I’d say at the very least five, but preferably ten years from the last sale of a new, used, or refurbished device sold by them or their authorized resellers. Require security updates for at least twice as long, or when the manufacturer can prove all devices are out of use.