Also as a software company you anyway don't want people massively using old versions of your product with publicly known security flaws. "New large YourProduct botnet noticed by security researchers" is never a good publicity in media even if botnet consists of sanctioned users' devices.