Uh, look at curl. It is an excellent product, no doubt about it (or if you do, I wonder what your standards for excellence are), and yet we are here, at version 8.0, 27 years after its first release.
Edit:
"if it doesn't rely on any online services"
That is a big IF. How many things don't, at least indirectly? (e.g. by relying on HTTPS, which requires TLS, which requires keeping up with current cryptographic standards.)
If cryptography can't possibly be figured out once and for all and must remain a moving target forever, I'd separate TLS into a module that can be updated independently of the rest of the system.
Edit:
"if it doesn't rely on any online services"
That is a big IF. How many things don't, at least indirectly? (e.g. by relying on HTTPS, which requires TLS, which requires keeping up with current cryptographic standards.)