Seems like they're trying to fix the problem of vendors not releasing security updates after 2-3 years of the product's launch by taking on the responsibility t

Seems like they're trying to fix the problem of vendors not releasing security updates after 2-3 years of the product's launch by taking on the responsibility themselves. They'd be looking at long term gains here