Yes. Many security updates come from upstream AOSP and then are put into GOS.

So when a device has stopped getting AOSP updates, it is unreasonable for GOS to continue support it. They can and I believe they have applied more critical security patches to just barely EOL devices, but this isn’t promised or expected.