Probably TLS version and maybe Google wants to drop Google Play Services from very old devices?
My guess: new TLS bug, or new WebView bug. These systems have no way to update without carriers back porting fixes, and Android H had such a small run that I doubt any carriers are willing to back port whatever fix is necessary.
Those phones are insecure.
Only because Google stopped supporting them.
The actual problem is OEMs. These devices have no auto update, so Verizon/Samsung etc has to write the updates afaik.
Google almost never actually provides end-user device support though. It's on the device manufacturers and they lose interest in like 18 months, or perhaps in 36 months if you're lucky.
Did Apple also drop support for equally old iPhones? I believe they provide security updates for at least 5 years, but I’m not sure.
I don't think Apple has any official "at least X years" support but they're generally pretty good about it. iOS 15 will be on the iPhone 6S when it launches this year, which will be a 6-year-old device at that point.
iOS 15 will support at least iPhone SE (1st gen), released in 2016 - so approximately 6 years of support indeed (if iOS 16 does not support the iPhone SE too).