I'm fine with saying that Windows 3.1 wasn't designed to be connected to the internet (it wasn't) so they are doing nothing. I recently got a recall notice from GM for a 13 year old car - they found a safety problem and it needs to be fixed even though the rest of the warranty ran out about 10 years ago.
What this would cause is for there to be one "product" such as "Windows" that Microsoft keeps up to date forever. They release patches and you apply them. The version never changes and everyone's machine is running the same product, but some of them are out of date and could be updated easily via Windows Update.
That’s their problem then.
EDIT: It’s not acceptable for consumers, especially in an age of "smart things" where their toilet, car, or in the next few years, even their house/apartment might fail, stop working, be infected by ransomware, etc due to missing security updates. At least if you sell software for Smart Things, you should have to put the source code in an escrow, and it would be published as soon as you stop supporting it.
For smartphones I would stay at the current 2 years requirement though. A phone stays most of the time on a person, which is one of the most harsh conditions if you think about it.