It depends. Vendors are obligated to handle upstream vulnerabilities once they become known, and commercial vendors are obligated to handle upstream vulnerabilities no matter what. The only situation in which a vendor can wash their hands of a vulnerability is the one in which they're informed of an upstream vulnerability and the upstream isn't, at which point that vendor is at least obligated to relay it to the upstream.
