That is a good point that US-based developers may not be aware of. The EU CRA (Cyber Resilience Act) mandates "an obligation to provide duty of care for the ent

That is a good point that US-based developers may not be aware of. The EU CRA (Cyber Resilience Act) mandates "an obligation to provide duty of care for the entire lifecycle of such products", mostly by requiring updates for security vulnerabilities. Any software that connects to the network (or Internet) has to be assumed to have a vector for vulnerability at some point in the future. This means that it has to be updatable, and cannot be a perpetual license.