It needs to be law for it to be taken notice of
Consumers don't know anything about IT but they all use these devices constantly in high risk situations. This has the potential to affect everybody else if these devices are commandeered into a botnet or otherwise spread malware or leak bank details due to flaws in Android which are left unpatched by manufacturers who have absolutely zero incentive to do so and they barely break even on some of these devices.
This is one way in which the law needs to be updated globally to force manufacturers of devices containing firmware towards a minimum 2 year period to have a security warranty with longer options for things like Teslas. This might even help reverse plateauing if everybody knows that after 2 years your phone cannot necessarily be used securely To do otherwise is the height of irresponsibility. Apple users don't have this issue obviously, so maybe buy iPhones until Samsung wakes up and takes notice.