It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs. Personally, I do not see any other way out of

It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs. Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.