The security content in Sierra (https://support.apple.com/en-us/HT207170) got me worried about whether there will be a security update to bring at least most of these fixes to El Capitan at least. I'm currently running Sierra myself, but my wife's aging MacBook got dropped off this year even though it's still perfectly capable for her use (RAM upgrade to 8GB and an SSD helps quite a lot with that). However, if El Capitan is going to have multiple unfixed vulnerabilities, it's really not a way forward. I do wish there's an accompanying security update to bring the fixes also to El Cap soon without requiring an OS update that's not available for the machine in question. Typically all of our hardware has been well within the active support, but now for at least a year we're on a more limited budget, so how long has Apple typically taken with offering possible security updates for older OS versions?