Presumably if a company doesn't build software in-house and "buys a product", then that's not R&D? Then, the companies making said "products" would be based in countries that don't have such draconian laws...