After maintaining online services, I’m quite sure it’s vulnerabilities. It’s extremely costly after 3-5 years to maintain old software.

Ex: You have a thermostat or an alarm system that runs Debian, Debian gets a vulnerability, you try to upgrade it, but you need to change Debian versions, and your old stack isn’t supported on the newer version. Nowadays you need to keep patching all your old appliances, keep the old domain names and exact URLs, and need to actively look for vulnerabilities. All of that can only be provided by a subscription, not the initial purchase cost: