By way of example, Debian has a stable branch which receives only security fixes, and even then, only if you run the update scripts. It will receive security updates for 5 years, and after that, will still be completely usable, provided you don't want new versions of software, or are willing to put in the work to compile them yourself.

Depends on the distro really. Linux (the kernel) doesn't have or require such a concept, but it's quite possible to build a linux-based system whose surrounding operating system is designed to work this way. My Meta Quest 3 is one such example. Linux kernel, but Horizon OS only allows updates to be postponed. It'll automatically install them and in one case soft-bricked itself, forcing me to recover manually. (Great job, Meta.)

This flexibility makes it difficult to make broad sweeping statements about the thing. Certainly however, it's impressive to log into a linux server and see an uptime measured in years. (Impressively horrifying, depending on your security posture, but impressive nonetheless.)