Perhaps if the software is more isolated? Many good points here, and I absolutely can avoid a lot of maintenance by my choice of languages and libraries, BUT just being online (or even on-network) forces quite a bit of maintenance.
I'm generally writing web apps, requiring me to keep up with a stream of security updates just to stay online: browsers deprecated TLS 1.0 and 1.1 [1], browsers require TLS certificates to be renewed ~annually, languages only fix security vulnerabilities for the last few releases, etc. Even linux kernels are getting shorter support going forward. [3]
I'm generally writing web apps, requiring me to keep up with a stream of security updates just to stay online: browsers deprecated TLS 1.0 and 1.1 [1], browsers require TLS certificates to be renewed ~annually, languages only fix security vulnerabilities for the last few releases, etc. Even linux kernels are getting shorter support going forward. [3]
[1] https://security.stackexchange.com/questions/237688/when-wil...
[2] https://www.digicert.com/faq/public-trust-and-certificates/h...
[3] https://www.linuxjournal.com/content/linux-kernel-reduction-...