Those updates are easy when you have to release a system update to update the safari browser. Hell, you could call it a major security fix and fix some security issue on an old phone and every fanboy would be like "OMG iPhone 3s got an update.🤤" whereas Google can just ship browser fixes over the app store.
Except that’s not what Apple means when they say they’ll update phones for five years. Security fixes aren’t the same as full iOS versions.
iOS 17, which came out September 2023, is available for the iPhone XR and XS, which came out in September of 2018. That’s a full OS update with all the non-hardware-based bells and whistles.
Security patches may very well release for older phones, but not full OS updates. Earlier this year they dropped a security patch for the iPhone 6S, a phone from 2015.