@nazokiyoubinbou @i0null
I agree that the principle is good. I also see that majority do not and have not for a long time done it. In the "before" days, when everything was not connected to the internet, it was possible to have, let's call it, legacy setups for a loooong time. As soon as our computers became interconnected, just about everything, starting with OSes (Windows, Linux, Android, etc.) and continuing with the most common programs, which tend to be communicaton-oriented, require constant security updates, that are rarely separate from function updates.
There is the ideal world and there is real one.
My guess as to why something that many claim to crave is not given is threefold: first, it would objectively take more time to maintain security-only support, even for those who are client-oriented; second, it is good for 'business' (see planned obsolence), where you need to upgrade to a modern, secure and shiny version; and, finally, because we let them, even as we complain about it.
If there was a true demand, we would have popular forked versions for FOSS (see Pale Moon), popular proprietary software that does not change needlessly, but we don't.