The source code gets released at the point when you're discontinuing support. At that point you still have it, and the team, you're just not planning to continu

The source code gets released at the point when you're discontinuing support. At that point you still have it, and the team, you're just not planning to continue supporting it tomorrow, so you release it now. If tomorrow comes and for the next vulnerability you can neither patch it nor release the code because you don't have it anymore, now you're in trouble, because you have an obligation to do one or the other. But whose fault is that? You had it a month ago and were supposed to release it before you delete it. Imposing penalties for that kind of pointlessly destructive behavior is hardly unreasonable.