If the security bug is bad enough... vendors do, sometimes, give into providing an update for an obsolete platform.

See also Microsoft, which patched the security bug used by WannaCry over 4 years after Windows XP end of life.