There is no difference between having closed component and one with couple of years lag when I need to fix some critical bug in it to release my app today.
Thank, that is interesting, to solve it: The lagged software should be given patch to critical bugs as soon as they are available, and the time lag for some products could be something like six months depending on the product. That is the company should provide patch for the critical bugs in the old version if such patch are available or help to solve that. The idea is that the company only keep the advantage of new features not taking advantage of critical bugs to sell the new version.