Also if it's mandatory? I would also say it's desirable to prevent the situation in which users just choose to have zombie devices because security is more expensive, but making them free or making them mandatory paid would both work for that

How would they make it mandatory, though? The only way I can think of making it mandatory would be if the phone bricks itself when the subscription ends. Or if you just lease the phone and the lease includes updates.

It seems like the best approach would be to just include the cost of updates in the price of the phone, which I guess is what every other phone maker does.