I think that just must be a law. I see no other possibility.

How would the law define ‘support ends’?

Also seizing source code at gunpoint seems antithetical to the notion of free software.

This is the question of security, see https://news.ycombinator.com/item?id=27387169.

> How would the law define ‘support ends’?

Whenever the company refuses to fix security bugs.

What if they don’t refuse - but are just slow or inefficient or produce bad fixes?

There exist more or less standard times for fixing security bugs. Let's say 90 days. If a company cannot provide security for their customers in a reasonable time, they must be held accountable.

Sure - typically the remedy for negligence would be compensation for the impact.

Seizing property at gunpoint doesn’t seem related to this.