I don’t believe it’s been years, only the latest firmware version for the ELAC is affected. The fix is to downgrade (or replace hardware with a unit running earlier firmware)

this is Airbus, not Boeing

I wonder who eats the cost of this? I presume it's the airlines.

So the immediate cost to Airbus of grounding the fleet is quite low, whilst the downside of not grounding the fleet (risk of incident, lawsuits, reputation, etc.) could be substantial.

I get the feeling that they are doing this partly for marketing purposes.

I would personally not want to seat in those planes in those 2 months.

I imagine it could help with Airbus marketing.

"We take proactive measures, whereas our competitor only takes action after multiple fatal crashes!"

From their viewpoint, you have to think about what happens if, after they became aware of this vulnerability, there was then a crash because they weren't prompt and aggressive enough in addressing it. That's the kind of thing that ruins your entire company forever.