The iPhone receives plenty of security updates, and does so relatively quickly after the fix has been implemented.
Apple patches the newests version of iOS. Sometimes older versions get a security update here or there, maybe. So you'd have to be running the latest version of you want security fixes. Which isn't always possible due to compatibility or performance/stability.
If your iPhone is 3 or more years old you can forget any support from Apple whatsoever.
Why not please your customers? Give them what they want? I don't even think the average customer would need a TOS of all the negatives using an older operating system brings.
They have a huge war chest. If a customer wants to be on the operating system that came on their device ten years ago; why make it difficult?
Could it be they want us to upgrade/buy regularly? For myself, I don't think I will ever buy another new Apple product. I will still give them as gifts though.