With the latest OS update comes updated security protocols. Many sites are not accessible or will not properly run if current security is not updated.
I don't know about "many sites" - while there are certainly some sites that require relatively recent security patches, the vast majority prefer
visitation and
usability to security.
macOS Sierra 10.12.6 last received a security update in September 2019. It doesn't mean there won't be others in the future - we just don't know. OS X El Capitan 10.11.6 (and the version of Safari that runs on it) last received a security update in July 2018. I haven't heard of many sites rejecting Safari on El Capitan, but I'm sure there must be some that do.
Meantime, since you're concerned about browsing... Google Chrome 80 (current version) runs on OS X Yosemite (10.10.x), and Mozilla Firefox 72 (current version) will even run on OS X Mavericks (10.9.x).
My Early 2008 iMac runs El Capitan. As a 12-year-old system, its ability to access websites is the least of my worries.
You have to distinguish between what Apple considers obsolete hardware, what hardware is no longer eligible for the current OS, and what OS is no longer receiving security patches.
Hardware: As others has noted, there's a firm rule for hardware - this has to do with maintaining an inventory of repair parts (and tools) and training new staff to repair that older hardware. In most parts of the world, hardware is "vintage" at 5 years from last date of manufacture, and "obsolete" 7 years from last date of manufacture. Even there, Apple has recently changed policy, and may maintain parts inventories (and offer repairs) for longer than that on a model-by-model basis - they just won't say which models.
OS: The ability of a particular model to support the latest version of macOS varies, because for the most part it depends on hardware compatibility with certain new features. For example, can the Bluetooth chip in a particular Mac support a particular Bluetooth version required for a new AirDrop feature? Apple then has to decide whether to issue the new OS to those Macs anyway, lacking support for that particular feature. In general they lean towards a minimum of exceptions - features that are prominently promoted tend to be available on every Mac that can install that OS.
Browser Security: Apple tends to push out browser security patches for around 3 years after the initial release of that OS, but there's no published, hard-and-fast rule. Some threats have been serious enough to warrant an exception.
And then there's
iTunes updates. Apple is still pushing out compatibility updates to iTunes for El Capitan and Windows 7 so that older computers can sync the latest iOS devices.
Overall, Apple's approach is, "Run the highest version of the OS your Mac will support." If you do that, then you can expect another three years of security updates from the date that OS was released. While dates vary, that can mean about a 10-year life before you can't get another security update, and for most web sites another two or three years after that before they block your browser.