If this is what's really going on, it strikes me as questionable corporate strategy. The whole industry has an interest in keeping the internet a safe place to be and if it means offering free security patches for several versions back, that would seem to be in their interest. It's like networks economics, the case being here that the more people who can be induced to stay safe (say by not having to pay for security patches), the safer the system for everyone.