probably yes

withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another