Good idea, and actually partly implemented as well in the EU. Security updates must be provided for a certain period of time for a certain class of devices, which is the reason why mobiles now receive updates for many years.