Most regulations work like that. For example, just because you are cooking in a food truck does not exempt you from basic hygiene requirements. Also CRA will not put you into hot water because of a vulnerability in your dependencies. You may get in trouble if you refuse to provide a security update during the lifetime of your software product.