Then they should also be held responsible for the fallout (technical or financial) caused by an unpatched security bug. Then it's just a liability and risk cho

Then they should also be held responsible for the fallout (technical or financial) caused by an unpatched security bug. Then it's just a liability and risk choice for them. If the user is not able to update, then they shouldn't be the ones on the hook if there are problems.