It has been that way for a number of years now (since iOS 15?). Previously they didn’t even provide those three months of overlap.
For devices that would support the newer iOS, Apple has NEVER offered security updates for the previous iOS versions for longer than 4-5 months.
In recent years I’ve been staying on old (current minus one) iOS versions for longer than that and could have sworn I was still getting security updates. But a review of the release schedules shows you are correct. I must have been thinking of macOS.
Personally I think it’s a bit sad and user-hostile that Apple does this. After all, they’ve already done the work to integrate the security fixes anyway so why not release it for all supported devices, just like they do for Macs?
There are often good reasons to stay on an older iOS version (better performance on older devices, software compatibility, fewer bugs, etc). Apple shouldn’t be leaving users who choose to do so with insecure devices.