You could argue that Google should set an explicit support cutoff date for patches for older versions, but when the handset makers policy on end of life ranges from "until the average contract runs down" to "until the retail store's return period has passed", I'm not sure there's much point.
I do argue that Google's role in this malfeasance is that they haven't contractually obligated handset manufacturers to make updates available for 2+ years after model introduction.
It's absolutely ridiculous that they are selling handsets right now that have known unpatched vulnerabilities, and will never have updates made available without rooting, shitcanning the OEM software stack, and loading a 3rd party community image of some kind, with zero culpability.