True, although that has happened with F/OSS as well (like with xz or the couple times people put Bitcoin miners into npm packages). In either case it’s a lot less likely than the software simply ceasing to be supported, becoming gradually incompatible with newer systems, and rotting away.
Except, of course, that I can pick up the decade-old corpse of an open source project and try to make it work on modern systems, despite how painful it is to try to get a JavaFX application written for Java 7 and an ancient version of Gradle to even compile with a recent JDK. (And then finally give up and just run the last Windows release with its bundled JRE in Wine. But in theory I could’ve made it work!)
Speak for yourself. I’m going to migrate all of my 22-bit RSA keys to a longer key length. And not 24 bits, either, given that they’re probably working on a bigger quantum computer already. I gotta go so long that no computer can ever crack it.
64-bit RSA will surely be secure for the foreseeable future, cost be damned.