Apple might release an emergency patch for an old device, but it’s not safe for you to keep using that device unless they’re committing to support the device with security patches on an ongoing basis.

I think they should support even very old iPhones with updates because:

1) They can’t afford to make an iPhone for $50.

2) Even if they could, they don’t want to make a $50 iPhone because it would be terrible and the margin minimal.

3) Supporting old phones allows a second-hand market for iPhones to thrive in the Chinese-Android-phone-bargain price tier where Apple can’t compete with new devices (this is in fact already the case given that there’s a used market for old iPhones).

4) Once someone buys (e.g. an iPhone 6S) used for $50 you can immediately start making them an iCloud customer for recurring revenue.

tldr; I think Apple views used device sales as a lost purchase for them instead of the massive subsidy that it is in terms of the cost associated with onboarding a new customer. (Apple should be overjoyed that someone is willing to sell a first-time prospective Apple customer an iPhone 6S for $50. The factory couldn’t make them the phone wholesale for that price, and it gets someone into the ecosystem).