You can't fire your SoC vendor especially once the product ships. And their are all PITA about security updates.
If you buy from a supplier with a contract that stipulates security updates then you certainly would define the damages which failure to fix will cause you, wouldn't you?
One of the issues is that the upstream vendor goes out of business. What you really need is to have the source code for the firmware, ideally in the public mainline kernel tree so that new kernel versions continue to work on the hardware.
Certainly true. Source code escrow should be part of any kind of company selling internet connected devices.
Nothing will change unless everybody changes.