Organizations sometimes depend on software that cannot be upgraded quickly because of old applications or hardware. A distributor or specialist vendor may continue issuing selected security fixes for that software under an extended-support contract.
The coverage is not automatically the same as ordinary upstream support. It can be limited to certain package builds, operating systems, vulnerability severities or subscription terms. A vendor may backport fixes while the upstream project considers the release end of life.
That is why the age of the upstream version alone does not answer whether a package is protected. Equally, the presence of an extended-support product does not prove the specific vulnerability has been fixed in the installed build.
Check the service's coverage and expiration dates, identify the exact supported package stream, and verify each relevant security advisory. Keep a migration plan because extended support buys time rather than removing the risks of old software.