I get where the ACLU is coming from, but I don't know if I agree that the customers didn't know what they were getting into and now have no recourse: ACLU Seeks Carrier Smackdown Over Android Updates
Maybe back in 2009 or 2010, they could have made a good case. Back then, consumers didn't know that most Android devices wouldn't get timely updates. By now (it's 2013), it's well established that your Android phone will probably not get a timely update unless it is either a Nexus phone or rooted.
Consumers, who now know that non-Nexus, non-rooted Android phones will either A) never get updated or B) get updates extremely late (months or years later) really have no excuse. If they want security updates, they should get a Nexus phone, learn how to root their Android phones, or buy another non-Android phone (e.g., iPhone or Windows phone).
The good news is the now-Google-owned Motorola will soon begin releases vanilla Android devices. Once HTC, Samsung, and LG see Motorola and Nexus phones flying off the shelves, they'll have to either start releasing updates in a more timely fashion... or just install vanilla Android with a different default theme. Vanilla Android is the way to go, people. Vote with your wallets!