I recently sold a nine year old iPad running iOS 17 that is still getting security updates (17.7.11 a few months ago). Even iOS 15 (released 2021) got a security update in May.
I believe if you have a much older iDevice that no longer supports the latest OS, they will keep releasing security updates for that device for a long time, which is good on them. But if you have a newer device, after awhile the only way to get security updates is a major version upgrade. You luck out if your device happens to be old enough not support to newer iOS versions.
