Indeed, but it seems to be close to the current "industry standard" at this point, for instance: Node LTS is 12-months support plus 24-months "extended security support". (Three years total)

Which is not far from say Ubuntu LTS at five years. (Python and Ruby have more confusing security fix policies than LTS/stable designations, but both are relatively close to the 3-5 year mark for security fixes.)

Definitely not "long" from the perspective of classic Enterprise development (or Windows "LTS" lengths), but from modern viewpoints it is "long". Interesting how such things shift culturally.