I completely agree.
I do find it interesting though, as someone who through work has deployed a lot of cell phones for field ops - the situation seems to be kind of, sort of getting better in that respect.
We bought a ton of Moto G4s and G5s in last 18 months, and for the first year, I saw maybe one OS update and a couple security patches?. In the past six months, it's been noticably different (and these phones are only getting older, mind).
I'm writing this on a Moto G5+ which has 7.1.1 and the January security patches, including fix for KRACK vulnerability. G4 models have the same patch level and 7.0. Updates have been deployed fairly regularly lately (if still not quite on a monthly cycle).
This from Lenovo, who have historically been terrible for issuing updates in a timely manner.
I wonder if the message is finally getting to these OEMs that they can't afford to let current models wither on the vine in this IT security climate, even if only for their own selfish ends (e.g. avoiding bad press).
I really hope so. It's way overdue.
Disclaimer: total anecdata, handle with gloves.