What audience is that? Who are these people relevant to? Microsoft isn't holding back anything, they can't force these people to update their software. If everyone keeps supporting them, they never will have a reason to update.
As for K-12, is that really a requirement in some places, or is it just the case that some clients just happen to not be updated?
More generally IE9 and IE10 are both still supported by Microsoft (for Vista SP2, Server 2008 SP, Server 2008 IA64; and for Server 2012, and Embedded 8 Standard), so it seems entirely plausible Microsoft would sell security updates for other OSes to clients willing to pay for them; they definitely do that for some clients (some still get security updates for XP!).