During Windows Phone's lifetime devices were rarely left un-upgraded or out of security support. Not quite as well as iOS, but much better than the Android situation. Arguably it was one of the reasons that phone carriers chose to kill Windows Phone because they seem to like being able to micromanage the tire fire that is Android Updates and Windows Phone was too "uppity" for them.

UWP isn't "dead" and its technologies continue to get updated.

Windows' left behind devices that no longer receive security updates are after at least a decade of active security support. XP was offered several lifelines, way beyond the security support of any single Android version in the history of Android. Windows 7 seems on the path to similar lifelines and maybe won't have quite the same record of security support, but will still see active security patches for much longer than any Android version could imagine.