These findings should also apply to phone manufacturers -- mandate providing a more realistic number of years of security updates. Closer to 7y but definitely more than 3y.
ultimately, it would probably force Google to just take it over (which to some extent they already have, but not completely).
Bad phones make for bad times for whoever uses the phone, not for anyone else. Also, people rarely get killed by bad consumer electronics.
Safety is one of the easiest arguments to make - esp. exploiting the horrific - "think of the children". What if my kid's phone camera can be remotely turned on in their bedroom?
One of the phones has a removable battery(!), still. Pretty much any other device/appliance has a plug or a mechanical switch (or both).