There is another side of this, which is that on a commercial WordPress plugin you do not charge for the code, but for the support and updates over a period of time.

The code itself, as derived from WordPress, is (or should be) GPL, which means that users with old versions can indeed get new versions from "lateral" sources if they want and can do it, but they will not get support should this "lateral" version not be safe or cover what he needs.

I work for a company developing commercial plugins, and we do know this by heart. We have trademarked our product names, but nothing stops someone from taking our code, getting rid of product names and API calls to our own upgrade system, and go with it.

So no, I do not think that someone that bought a plugin at some point should get security updates for life since that is exactly one of the things that you pay for. There can be some grey line if a security breach was found the week after your subscription expired, but at some point the deal is broken.

Otherwise, someone could take WordPress as guilty for keeping old insucure plugins outdated in the plugins directory, which does not make sense at all.

Just my 2c.