> If I sell you a lock, and then 10 years later someone finds a vulnerability with the lock I sold you, should I refund you?

Kryptonite did exactly this when someone figured out they could open their U-locks with a Bic pen barrel. Full recall of vulnerable products, with free replacement, regardless of age.