Fit for purpose?
So if any phone bought in the last 12/24 months from a UK/EU retailer that runs an affected version of Android, and does not receive a security update, can the owner rightfully return it for a full refund as "not fit for purpose"?
If a large number of people returned phones within the statutory warranty period because of a lack of security updates, the retailers might have to be more selective about which makes of phone they stock.