IE9 gets security updates on Vista SP2.

More generally IE9 and IE10 are both still supported by Microsoft (for Vista SP2, Server 2008 SP, Server 2008 IA64; and for Server 2012, and Embedded 8 Standard), so it seems entirely plausible Microsoft would sell security updates for other OSes to clients willing to pay for them; they definitely do that for some clients (some still get security updates for XP!).