The tricky part is determining how long software should be supported for, at least with respect to security updates. I'm sure that most people would agree that

The tricky part is determining how long software should be supported for, at least with respect to security updates. I'm sure that most people would agree that 5 years is insufficient. Twenty five years, many would say is too long. As for the car analogy, it is a weak comparison. First of all, the owner is expected to do some upkeep. A car is more likely to be deemed unroadworth from a lack of upkeep as it is from a design flaw or manufacturer defect. The other consideration is that the notion of secure software is a shifting target. In the case of cars, physics is a passive adversary. In the case of computer security, the adversary is active. Is software security to be judged by the security standards of when it is developed, or of when it is used? The former will catch cases like this, but will prove ineffective in the long term. The latter will bankrupt the industry.