Not sure this "expiration date" helps consumers much
Sure, people who read El Reg know the security risk of IoT devices and the importance of patches, but the average consumer probably associates patches with Flash constantly bugging you to update or Windows wanting to reboot at an inconvenient time and might go out of their way to buy the one with the shortest patch window!
The other problem is just because the OEM has committed to delivering "patches" through 2020 doesn't mean all security issues will be addressed. Sure, if some really bad exploit comes out that could be used to cause your toaster to set your house on fire they'll fix it, but if there's something that can cause your toaster to go from off to some sort of warmup state that consumes 100 watts 24x7 they might ignore it.
Biting the hand that feeds IT
