Comment by Vuska

WordPress 3.7, which introduced automatic updates, received security backports all the way to 3.7.41. From 2013 to 2022. 4.1 and above are all still receiving them.