I guess the key thing is that they promise the security fixes for 12 years.

This is interesting, because in large org you ofren have lot of stuff you just want to keep on running with minimal changes.