Samsung has published an update to its security patch update roadmap. It outlines which devices get monthly, quarterly or less frequent upgrades of this nature, revealing in the process that the Galaxy S7 and S7 Edge are on neither of these lists. This, then, definitively marks the end of the series' life.
https://www.notebookcheck.net/Samsung-discontinues-official-support-for-the-Galaxy-S7-series.460166.0.html
I'm trying to think of a way that the EU could force companies to at least give security updates for longer, but it sincerely looks terribly complicated to enforce.