A huge volume of purchases (including in the EU) are direct to consumer from Amazon. There are a
lot of fly by night brands on there and you'd be surprised how many of them seem to no longer exist within a year or two. Your big company backed Samsung phone might get security updates, but the IoT junk in question is not likely to.
Re battery longevity - see the power bank bans by the TSA in the US. Maybe you are getting lucky or are only purchasing products from reputable long lived regulated vendors, but the sheer volume of vulnerable devices does not come from those products