I disagree that it breaks the trust. No one buys a computer and expects software updates 20 years later. Of course you can make the case with Linux, but that's a general purpose OS and requires knowledge beyond that of a typical consumer. A more apt analogy would be to expect Microsoft to still provide updates for Windows 98.

If you're going to support legacy hardware indefinitely, or even for decades, you're going to have to continuously add developers, and developers for legacy code are super expensive. Sure, COBOL still works fine, but you have to pay someone $250k a year to maintain it.

If the public expects their smart devices to be supported for 20 years, then their expectations need to be broken. Hardware, cyber security, and resource utilization will continue to rapidly evolve, and old equipment literally won't be able to keep up.

Hell, most of the smart devices out there have critical vulnerabilities. The ESP32 stack has been found to have hidden commands whose attack vector isn't fully understood. Literally every smart device on the market should have been EoLd months ago, and I can only imagine what holes tech from 2014 has.

The people down voting me to hell just don't understand how fucking dangerous the Internet is, and how much effort is required to protect an infrastructure. People like me bust our asses to keep shit like this safe, but there's a limit to what we can reasonably be expected to do. We're already really fucking overworked.

Of course, I would prefer that it be codified into law that companies need to allow the ability to manually flash a firmware before marking something EoL. Block it from your servers, but let volunteers maintain the hardware for as long as possible.