IMHO If you are doing a product, you should be doing your own RelEng and support. It takes about two engineers for good coverage.
And your internal releng process should be handling security issues as they come up?
That may start to get rough with MFCs as the branch petrifies, but yes it should fall within the same crosschecked two engineer budget for a reasonable time span. You should seek commit bits to maintain said branches if you rely on them, because you're probably not alone.
FreeBSD is switching to a 5 year window.
For point releases? Or for ABI compatibility?
Edit: Went digging. Here's the link: https://lists.freebsd.org/pipermail/freebsd-announce/2015-Fe...
It's for ABI compatibility.
It certainly adds a certain amount of certainty to the planning process. Right now, I'm running off 11.0-CURRENT in preparation for a deployment or around August 2016, which gives me certainty of support until mid-2021.
Are you doing HW that is frozen in time? I would suggest that many things should be branch rebased roughly every two years unless there are extreme circumstances. I think EMC Isilon has recently realized this as example.
(I have a view here, but I don't want to bias your response one way or another).