Using an open-source OS isn't a panacea. If $vendor ships a dynamically linked binary tied to a libc version that shipped in Ubuntu Warty Warthog, your upgrade path is just as broken.
It would still cost money, but at least there's a legal path forward.
Better still would be having a device that operates on some commodity connectivity using standard protocols (APIs/etc) which can be soft-gaped by a firewall / guard that only lets well formed (or at least expressly authorized) requests in.
The open source OSes do go extremely out of their way to provide and keep userland APIs stable, in many cases modern hardware that would be completely unsupported in XP or some other proprietary OS, and again, if something that used to be depended on somehow falls out of support you're at least actually free to pay someone to add in the support you need.