Yes, Google Play services, where most of the attack vectors lie, will get updated. Most people don't keep a phone that long but change it after 4-5 years or so

Yes, Google Play services, where most of the attack vectors lie, will get updated. Most people don't keep a phone that long but change it after 4-5 years or so. How many 5s still exist in the wild?