>The issue isn't malware authors acquiring it the source, the issue is that other people would then build said source and run it (XP) or worse, build products on it as XP was very stable. Those systems would then get infected and become botnets.

I don't follow where you're going with this. Why would they build the source or build products on it if they were not interested in deploying security fixes? There is no other developer interest there and no company would ship a white-labeled "XP 2020 Edition" to developers if it was instantly vulnerable to malware.

>Sympathy doesn't matter in the business world, costs do. No normal company is going to undertake a legal review of an unsupported product; it simply isn't worth it.

Right, that's why I don't buy these lines about how they can't afford it. If it becomes a serious security issue that causes them problems then it is worth it.