They should offer paid-for upgrades after 3 years
It's unsustainable to put the costs on the backend, so phone's price would have to be raised to cover those extended security updates. But, that won't happen for a budget phone. There just won't be enough people willing to pay after three years.
That's the problem with purchasing a budget phone. You get what you pay for, a phone that will go away soon.
Which is why this reads as kind of a stunt. A repairable phone is great, but if it becomes unsafe to use then what's the point? The software needs to be "repairable" too.