That’s the thing with software, you can automate most future updates, with LLMs and whatnot.

Also, the initial software probably didn’t have a lot of known cves when it was sold.