You can stay on an older version for a little while, maybe a year at most until it stops getting patches. Then you get to make the choice of using an OS that's vulnerable to exploits and an OS with a gigantic backdoor in it.
Catalina should be supported for two more years:
https://computing.cs.cmu.edu/desktop/os-lifecycle
https://www.csun.edu/it/supported-operating-systems
https://www.reddit.com/r/sysadmin/comments/imdzv4/endoflife_...