This might create a bias towards large vendors with huge human resources to throw at maintenance. But it should be illegal to sell devices and hinder third parties to fix bugs and develop security upgrades, for example through closed software platforms, drivers and interfaces.

I don't know about illegal but they should be forced to prominently advertise their security update lifetime. Sort of like energy labels are put onto household appliances or nutrition labels are put onto food.