2) True. So what? Why should that get them off the hook? Statistically, we also know that people will always make mistakes, does that mean companies shouldn't be responsible for the blunders of their employees?
The fact that we know our software will have problems we can't fix at launch time just means we need to account for that post-launch cost, plus possibly have insurance for major screw-ups. It doesn't mean we get to claim "caveat emptor" unlike any other industry.
If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you.
Yes, that's currently the case, as I admitted in my other post, but it's not an immutable law of nature.
1) Perfectly secure software has never been invented and may never be. Does that mean all software has "manufacturing defects"? It definitely means you can't penalize the "manufacturer".
2) Not all security holes are defects that are discoverable when a program is released. There are attacks that no one has thought of. Someone invents the attack, tests it, and then discloses it (or uses it). The average coder isn't anywhere near smart enough to think of all these things (and that includes me). Even if we were, we wouldn't have time to test and mitigate all of them.
If you want to get the exact same piece of software updated only with security patches, you'll have to select software that is updated this way or pay someone to write it for you.