I think the correct tradeoff is to judge the malfeasance of the product based on what security precautions were reasonable at the time the product was created.

Granting that "reasonability" is a very fuzzy standard, it seems obvious that a product with 30 year old crypto should not be subject to lawsuits because someone got solved integer factorization on real hardware.