Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.
There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.
This is how it's done everywhere I worked. You can patch some bugs for cheap in the software, but you can't fix hardware limitations. I know companies that use PLCs that still don't support encryption despite the upcoming EU regulations.
The companies either don't care or are too greedy to spend money on this.
Oh yes you can patch it - that's how I got the 20 year old laminator working where I work. If the hardware is still good you can absolutely change firmware if you have the PLC control software (like RockWell ControlFlash) or know how to manipulate the ladder logic directly.
As long as you have room in memory, you can add functionality.