Yes, security is important. Either the developer/company is benevolent or incentivized to provide security patches for free, or they may offer a paid security update package. The US Govt was paying for patches to XP for many years: https://time.com/3935855/us-navy-microsoft-windows-xp/