A fix is not an upgrade.
A "security fix" is not an upgrade, it's fixing a bug that existed at time of purchase, so as soon as a company stops providing security updates, you should be able to get a full refund, as the device is (and has never been) "fot for purpose"