This almost always means "security patches" but the general public almost always interprets this as "feature updates" and tech journalism never manages to draw the distinction.
They also released iOS 15.8.2 this last march, this one goes back to the iPhone 6 from 2015, a device that is 9 year old and still getting security updates.
So while they are only making a commitment for 5 years, in practice they are doing, and have usually done, for much longer then that.