You're holding it wrong.
Phones should be required to get (at least) security updates for (at least) the same period as they are covered by repairability requirements.
Phones should be required to get (at least) security updates for (at least) the same period as they are covered by repairability requirements.