Because Microsoft has decided to continue providing security patches for severe vulnerabilities despite it being out of support: https://techcrunch.com/2022/09

Because Microsoft has decided to continue providing security patches for severe vulnerabilities despite it being out of support: https://techcrunch.com/2022/09/14/microsoft-zero-day-windows/ https://techcrunch.com/2022/09/14/microsoft-zero-day-windows... But you have no guarantee from Microsoft that they'll continue to do so like you do with something still in lifecycle.