In Europe that's the law. 7 years of security updates.
You can (and manufacturers do) release security updates for past major-version releases without backporting features.
alt Hacker News
You can (and manufacturers do) release security updates for past major-version releases without backporting features.