By way of example, Debian has a stable branch which receives only security fixes, and even then, only if you run the update scripts. It will receive security updates for 5 years, and after that, will still be completely usable, provided you don't want new versions of software, or are willing to put in the work to compile them yourself.