Usually all it takes to keep one's software running on macOS is compiling against the latest SDK once every ~5 years. Depending on the nature of the app, source changes often aren't even required. As a dev I don't think that's too much to ask.
A lot of that is going to depend upon perspective.
Take something that is coming up: Apple has mentioned that Intel application support is going to end in the next release, or about 8 years after the introduction of the M1. Eight years may sound like a good run, but there are all sorts of edge cases: software that doesn't receive updates because the publisher is no longer in business, or software developers who are providing updates under a disagreeably different business model (ahem, subscriptions). Some software may have been released Intel only after the release of the M1, simply because the developer wasn't going to test a new architecture immediately after its release.
I'm not going to pretend that I know how much software that affects, because there was a 12 or 13 year gap in my use of Macintosh. Something I did notice after my return to macOS was the absence of software due to earlier changes in the platform. An more exotic example is F-Script[1]. Not only is the project gone, but the change in the security model pretty much ensures that nothing like it will ever exist again. A more common example will be games, where only a select few will receive updates a couple of years after its release.
It’s also notable that virtualizing macOS on macOS has now been officially supported and easy for several years, so it’s possible to just spin up a VM running an old version of macOS for software that requires Rosetta. Some kind of containerization probably isn’t a bad idea in that situation anyway, as software that’s gone so long without updates likely carries a number of vulnerabilities.
And on that note, the highly permissive state of desktop OS security as it had been for the 2000s and 2010s was never going to last. It’s been proven repeatedly that third party software must be treated adversarially, both because the big guys like Adobe can’t be trusted to keep their fingers to themselves and the little guys and FOSS projects sometimes fall victim to supply chain attacks. The OS must try to limit the blast radius where possible.
[0]: https://developer.apple.com/games/game-porting-toolkit/
FWIW, limited to two macOS VMs per host unless you hack it.