There is a kind of perverse incentive not to work too hard to secure software when doing so removes a critical reason to buy the updates.

That being said I do think truly securing an application requires first having a secure platform. Otherwise users could indefinitely demand mitigations at the application layer until it contains most of its own OS.