I consider recalls valid and customers should be made aware of vulnerabilities regardless of license status. But customers need to opt-in. Burn this into your EULA.