It's far more nuanced than what the article makes out. Note that Rapid Security Responses (RSS) for example went out for iPadOS/iOS 18.1.1 and for legacy devices iPadOS/iOS 17.7.2 on the same date (19 Nov 2024), both which addressed the same security issue. You will also get times in which a current-year OS update introduces a bug or vulnerability which will then require an RSS to fix, but which wouldn't be necessary for a legacy OS. However it's not unusual for Apple to release security updates for three OS versions simultaneously for the same issue, which happened 22 January 2024 (17.3, 16.7.5, 15.8.1 due to an issue in WebKit).
It's a fact that Apple states only the latest OS is guaranteed to receive all security patches. Most people don't care about patches; I know plenty of people running a horribly out of date Windows computer, when Windows isn't even as secure as iOS. OP hasn't even said whether they care. And yes, new code means new chances for vulnerabilities. That's the reality of software.
It's far more nuanced than what the article makes out.
Well, I'd say it's "far more nuanced" than you stated in your original comment.
To provide some examples of what I mean when I say it's for the more serious issues, I'll use your example of 22 January 2024 (17.3, 16.7.5, 15.8.1). Per Apple's disclosures, in 17.3, there were
19 vulnerabilities fixed; in 16.7.5, there were
9 vulnerabilities fixed; and in 15.8.1, there were
2 vulnerabilities fixed, both of which state:
Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
So, Apple only fixed the most serious vulnerabilities that were
actively being exploited against those older devices.
The iPhone 5S with iOS 12 is sometimes held up as an example of how Apple gives security updates for 10 years, since they released security updates for it in 2023! Let's look at those updates (12.5.6 and 12.5.7). Both have a single vulnerability fixed, with the note that
Apple is aware of a report that this issue may have been actively exploited.
The current OS receives all security patches. The previous OS receives most of them, and probably all of them during the intermediary period before Apple starts pushing users to upgrade. The OS before that receives some critical patches.
I don't say this to scare the OP. Apple devices in recent years are very secure, and most people are well served by using a good adblocker. But to say they get security updates for two more years after losing support is only partially true.