Only if there's an absolute bare minimum they're allowed to choose of 5-10 years after the last device/software is sold.
And even then, I still think they should be required to unlock devices (and software DRM bullshit/APIs to re-implement server components) to allow people who want to maintain them themselves.
Because it opens them up to obscene liability if they don't have enforcement and age verifications well outside the range of what anyone who isn't a massive business is capable of implementing.