People already have been brainwashed on "how many years of security updates does this smartphone model have?", and being paranoid about older-than-a-few-years devices, so you're not far off.

(Not trying to diminish the necessity of software security updates, but at the same time I could not find any Android exploits that do not involve users installing malicious apps, supply chain attacks, or state actors)