Something like myfitnesspal or a thermomix shouldn’t be a subscription, there is no major updates to how someone tracks their exercise uses a hot blender that justifies it beyond users being locked in.
I won’t dispute that both of these likely abuse the subscription model for their benefit. But they definitely have a social responsibility (and in many cases a legal responsibility) to keep updating the software in these products and the network infrastructure that go with them. The internet of things is one of the most vulnerable attack vectors we have. It has been exploited many times not just to attack individuals, but to create massive bot nets that can target corporations or even countries. The onus is on the manufacturer to continuously keep that at bay. You know what they say - the “S” in “IOT” stands for security.