I totally agree. But the amount of pressure required is incredibly big. As in, Google has been trying it for years in the Android world and is only seeing success now with drastic measures that vendors hate, like forbidding use of any kernel patches outright.
Yeah... this might be something that needs legal action, like manufacturer liability for security issues within a specific timeframe...
(could even be a "best before" date on electronics; at least this way you know what you get when you buy, the vendor can decide on their own how much support they want to offer, and the user can choose between the "good for 2 years" router and the "good for 5 years" one...)
