I think software sellers is doing a courtesy when they provide security updates for free. They are not legally obligated to do it. The users are entitled to switch to a competitor however - by not having their data held hostage (which, i think modern laws don't properly address).