The software support hinges on SoC vendor support. You can only support it as long as the SoC vendor supports the SoC. Afterwards you can provide quasi support, for the upper OS layer only. Critical modem vulnerability past that point? SOL. I’m not aware of the current vendor support across brands but the last time I checked QC offered ~3 years and I think that’s from introduction of the SoC, not when it shipped in devices. I don’t know if anyone who sells their SoC offers longer support. It’s sad stuff.