I am not a fan of this idea as it would only contribute to eWaste, but I think one aspect I can get onboard with is a clearly defined expiration for updates.

I think we would be getting too far into the weeds to specify what "security updates" means as there will always be ways to work around the language, but the fact that a manufacturer will guarantee a certain expiration of updates would be better than where we are now. If a vulnerability is discovered before expiration, presumably it would give the market and consumers leverage to hold the manufacturer's feet to the fire.

I think no nonsense update expiration dates is a very easy win.

Bricking the device after expiration or if it can't communicate is just a non-starter for me. Many devices can find a second life if manufactures were incentivized to open their hardware vs close it. Under a brick after expiration scenario I worry manufactures will be incentivized to lock down or prevent tampering to avoid exposure to torts that this rule might open up.