This sort of began when we all got the impression that software should be free, or that we pay a low price once and get indefinite free upgrades. Given that developers need to be paid, and resources cost money, there needs to be a way to rectify that gap between the consumer and maintainer. At one point we did so by paying for an initial version of software, and then paying for updates. Now that we don’t do that, but…
I would still gladly pay for updates—nobody expected to get updates for free, we always did it that way before. My impression is that the AppStore model, with the updates provided for free (for bug fixes, etc) is what began that shift to subscriptions. Before the App Store, it wasn’t easy to update software, so it was straightforward to lock updates behind paid upgrades.
if there's a security vulnerability, i'm sure you'd expect the update to be free.