To me, thats the minimal necessary solution in case of a vendor going bankrupt but there should be a mandatory minimum Support window after the last sale of a device by the manufacturer and that should be non-trivial for security issues (say 10 years).