I don't think Apple typically releases security updates for older versions of iOS, although they do for the Mac. I don't see any iOS 8 updates available after 9 shipped, for example:

https://support.apple.com/en-us/HT201222

I believe your overall point remains valid, though. The most recent hardware that can't update to iOS 9 is the iPhone 4, which shipped five years before iOS 9, and was last sold 3 years ago.