Selecting a part for a product with a ten-year service life is a sourcing decision wearing an engineering costume. Peripherals and clock speed decide whether the design works. Availability decides whether it ships in year seven.
The questions that matter before the datasheet
Does the vendor publish a longevity commitment, and for how long? Is the part a member of a pin-compatible family, so that a bigger or smaller sibling is a footprint-free change? Is there a second source, and is it genuinely a second source or a rebadge of the same die? Is the toolchain something you can archive — a released compiler version with a perpetual licence — or a cloud service that will be retired on somebody else’s schedule?
Designing for the substitution you will have to make
Leave the pins you do not need unconnected rather than reusing them for test points. Keep the bootloader interface on a connector, not on a pogo-pin fixture that only exists in one building. Write the hardware abstraction thin enough that a port is a week, not a quarter. And buy the lifetime quantity of anything with a single source at the moment the design freezes, because the notice period on a discontinuation is shorter than the qualification of a replacement.
The uncomfortable part
None of this survives a shortage. What survives a shortage is having decided, in advance, which functions are allowed to move to a different part and which are not — and having the test coverage to prove the move was harmless.