For End of Life products without anymore updates available… there could be a final update in the catalog that has the same applicability rule(s) detecting the EOL product being present on a system but instead of installing an update actually removes the product. That could be paired with a checkbox in the publisher service configuration app to “Automatically sync removal updates for end of life products”.
When one of these EOL product updates sync, it could trigger a notification email to be fired off to a configured email address as a warning. These "EOL Removal Updates" could show up as "Product Decommission - " and would really help to round off the whole patch management life cycle for the 3rd party products. To avoid a mob with angry pitchforks from showing up at the door, by default, the option could be disabled until turned on through the publishing service console, or possibly be an option that could be enabled "per-product" as well as globally.