[egorfine]

It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs.

Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.