Long-term support is critical. For example, Microsoft excels in that area and has patched its really old products to meet new PCI recommendations such as TLS 1.3, which can actually save a lot of money.