The thing missing is somebody to define that severe security vulnerability is considered as a defect in the product. Once this is done, consumers can either demand the seller to fix the problem, replace product or give refund. This should pretty quickly create a financial incentive to sell products which get updates.
Still, yea, this is exactly the kind of thing that needs to become commonplace. Hopefully it will be, though this is far from the first time that something like this has happened and here we still are.
Still, even just the fact that companies are now thinking about this and providing ways to download/delete your data makes me love the GDPR.
Easy to do the same thing here, as long as the company has (and wants to keep having) presence in the EU that's enough to enforce standards worldwide.
It would be just the question of somebody testing it. Take a relatively new() device with unpatched security hole, try to get it replaced/refunded and if necessary proceed to court to get a decision on the matter.
Although I wonder if any vendor actually wants to go to court arguing that a product with severe security issue is actually working as intended.
() Safe bet should be a device purchased less than 2 years ago, since that seems to be the time the vendor is at least responsible for defects.
Or an incentive not to sell in Europe.
Of course that doesn't fix the global problem.