Even if there was no mention of this or the implication that it’s linked to the notifications Apple sends for targeted attacks, is it fair to say this kind of backdated security patch implies a lot about the severity of the vulnerability? What’s Apple’s default time frame for security support?
This isn't thaaaaat far out of support. Their last security update for iOS 15 was just earlier this year, and they only dropped iPhone 6s from new major versions with iOS 16 a few years ago. As someone who has kept my last few iPhones for 5+ years each, I definitely appreciate that they keep a much longer support window than most folks on the Android side of things.
I assume they know just how long their customers keep their phones and maintain them accordingly.
I fully expect to be using my current Android phone into the 2030s.
This is the same for absolutely every manufactured goods. The same durable car model will be kept for over a decade by some people while some other opt for a leasing plan that guarantee a new car every two years. But the intrinsic quality of the car remain unaffected.
To ponder this you must consider what become of the phone they replace : did they trash it or did they have a second life with a less edgy owner?