When I worked for an enterprise Linux vendor, we definitely provided long-term support/maintenance options followed by security patches. It was mostly for government-related but also for some companies, especially those that were using it for embedded applications. But we also had meetings with those customers regularly who certainly weren't just installing the software and not touching it for 10+ years.

I've also known customers who have old software, e.g. for test systems, just running on old systems who basically don't breathe on the ancient systems. For years, United's entertainment system would also sometimes reboot to a 20+ year-old pre-Red Hat Enterprise Linux kernel but that's not really a critical system.