My guess is that this is covered by the third point - if you EOL security patches for a device I am guessing you are no longer expected to act on vulnerability

My guess is that this is covered by the third point - if you EOL security patches for a device I am guessing you are no longer expected to act on vulnerability reports.