The EU Cyber Resilience Act should not retroactively apply to legacy products