I guess only security updates are mandated. With an iPhone you always get the newest version of iOS and many/most new features, not just some patches.

No, besides security updates the regulation also covers corrective updates (i.e. bugfixes) and functionality updates for “the same OS”.

Personally I would actually prefer stability over having the system and UI changing every year, and getting slower every year on older hardware.