And if a company dies, the IP of all its products go to the official receiver - who should put them in the public domain.
Everyone with a phone should be entitled to join a class action against any manufacturer who does not provide a way to fix security problems - so long as the phone is capable of operation: ie until physical death of said phone.
Separately, there ought to be a law preventing sale of undocumented hardware to the general public. If you don't know what it is you own, how do you know it is safe to own it? If the manufacturer prevents you from knowing, surely he takes responsibility for its safety, and should be required to place a bond with the government covering the maximum possible risk (of being sued by all phone owners, everywhere, repeatedly, with the highest legal costs that lawyers can imagine).