EOL time span for Liferay DXP is part of the contract, and can be extended.
EOL for Liferay CE is not quite as committed (as far as I know): You
should be on a relatively recent version, and issues are typically
fixed in a new release. Occasionally, source-patches for prior
versions are released, but there's no actual prediction for how far
back a patch goes. Typically they're for security issues.
Note: I can easily be proven wrong on those statements - take them
with a grain of salt.
Some more proper wording is on https://liferay.com/security
and https://liferay.dev/security.
