Well, if the company is willing to live with the risks/liability of a still-supported product containing unfixed vulnerabilities then they're clearly not long for this world. Eventually someone will sue--no matter what the support agreement/TOS states--and they will win. Even if they don't it'll still be a pointless large expense for the business.