I would hope that this becomes relatively simple at some point.
1. I have this box that says I get updates until 2025-01-01.
2. It is 2023-09-05.
3. I have applied all available security updates.
4. Vulnerability X is still exploitable and has been made public to the manufacturer for 4 months.
5. Get full refund for defective product.
Obviously we are a long way from this. Especially 4 being hard to make a concrete rule for.