I'd go much further.

Either you fix anything that is broken, i.e. bug fixes both security and non-security related, or you should be required to let the people who bought it fix it, forever.

Did you stop supporting Windows 95? Ok, time to put it's source code and build tools into the public domain.