Here you have to distinguish which time has expired. There is a point in time when the manufacturer no longer brings out new releases for a device x, but the relevant point in time when security patches are no longer delivered may not be until many years later. Here’s an example:
The iPhone 5s was released in 2013 (iOS 7.0)
The last iOS for this device was in 2018 (iOS 12.0)
Last week Apple released a security update for this device (iOS 12.5.7)
In terms of security, you are still up-to-date even with a device that is almost 10 years old.
In principle, the investment protection for Apple devices is much higher than for other manufacturers. In the meantime, various manufacturers of Android devices have increased their support times. However, this only applies to devices of the latest generation, i.e. not retroactively.