Planning the CentOS 8 endgame

I don't understand your comment about a lack of warranty in the license. The public is not a party to that license, and so warranty or otherwise with another party is irrelevant to the public who bear the cost of future misuse of this unmaintained system.

At the present both regulation and regulators are not familiar with this particular form of pollution, and don't yet have a regulatory response. This episode is yet another example of the need for cyber security regulators to lift their eyes beyond government and military systems. As cyber security regulation stands today, IBM Red Hat will not even pay the costs of the negative externalities which will fall upon the non-contracting parties.