If Apple delivers a defective device to the customer, I see no reason why they shouldn't be fixing it using the money the customer originally paid. A security vulnerability may eventually leave a device completely unusable.