Apple doesn't really promise anything, but they released 17.7.8 two months ago, and some devices have received security updates as long as five years after OS support ended.
In general, the risk of falling victim to a vulnerability due to an outdated i(Pad)OS is very low, unless you are someone specifically targeted by state actors or