Sounds wonderful, but the entire Android platform relies on patches from upstreams (Linux kernel devs, Google, device driver vendors. Numerous other open source projects that contribute critical components). Timelines like that simply aren't possible. It would kill Android stone dead.
I upvoted because it's an actual concern, but don't agree with your point. Of course non-profit vendors should be excluded from such regulations, providing a best-effort solution.
For other vendors, that would actually be a feature. It would incentivize hardware manufacturers to stop bundling bad/broken Androids with their hardware, open the bootloader and partner with serious free-software organizations who won't break your system or backdoor it. If you really want to roll out broken software for your customers and not give them a choice, pay up.
Then the commercial upstreams will have to provide patches in time in order to still be able to sell their products downstream-wards.
For the open source upstreams... I've heard they accept patches. If not, the source is open, the downstream vendors can fix that. They can even put together a pool, pay into it together, and use the pooled money to develop (and hopefully upstream) a patch...
