There are backports of security fixes for older versions I think, just not offical from the PHP devs. I do not know much about it but WordPress (Requires 7.0 s

There are backports of security fixes for older versions I think, just not offical from the PHP devs. I do not know much about it but WordPress (Requires 7.0 since very recently) used as part of their explanations (excuses) for their extreme backwards compatibility that some of the major webhosts used some special PHP versions to account for security risks while still serving with old versions.