Only if the cost*risk of a future compromise is > cost of replacing the product. This is rarely going to be the case for business critical software.