Using an open-source OS isn't a panacea. If $vendor ships a dynamically linked binary tied to a libc version that shipped in Ubuntu Warty Warthog, your upgrade path is just as broken.

If that's done then there's at least still the option of trying a more recent version of the library, and if THAT breaks paying someone to write a compatibility wrapper for it.

It would still cost money, but at least there's a legal path forward.

Better still would be having a device that operates on some commodity connectivity using standard protocols (APIs/etc) which can be soft-gaped by a firewall / guard that only lets well formed (or at least expressly authorized) requests in.

The open source OSes do go extremely out of their way to provide and keep userland APIs stable, in many cases modern hardware that would be completely unsupported in XP or some other proprietary OS, and again, if something that used to be depended on somehow falls out of support you're at least actually free to pay someone to add in the support you need.

This is (at least partially) true, but it strikes me as whataboutery? Yes, open source vendors can fail to follow good open source/free software principles just as closed-course vendors can, and yes "medical equipment is now mostly open source" is not the end of all progress.

Thousands of consulting companies would be happy to provide repositories with security fixes and long term support services.

C programmers are a lot cheaper than capable reverse engineers, though.