Declaring a short product lifetime would not be allowed.
this makes no sense. it's an entirely different issue, plus you simply can't force anyone to provide unlimited support.
My point was to stop a vendor saying that the product lifetime is 3 months and thus using this as a get out from having to provide updates over a reasonable period. Quite how long is another debate.
Also: this need not apply to all s/ware and all bugs equally. Some which, for example, can lead to a security failure exploitable from a remote location if more important than a local cosmetic issue. Deciding a classification is a bigger can of worms than it seems at first sight.