Why does product security have to plan for a much longer horizon than information security?

Question

Accepted Answer

A product ships to customers and stays in the field for 10 to 20+ years, so it must be patchable and supportable long after the team that built it has moved on.
Information security protects the company's own IT. It can replace a server every five years, and
it can patch on its own schedule because it owns the machines. A sold product, such as a
laboratory analyser, a car or a PLC, belongs to the customer. It may run for decades on hardware
and an operating system that were current at launch, often in places where updates need
certification or downtime that the customer has to approve.
That lifespan is the key difference, and it explains the rest. Patching, testing and overall
complexity matter in both disciplines. A long-lived product, though, needs a support and update
path, spare cryptographic margin and a secure end of life planned from the start.
Go deeper:

European Commission — CRA implementation FAQ — how the CRA turns lifespan into a legal support period
 Operational technology (Wikipedia) — why industrial products stay in the field for decades