There were 4 years of ESU giving that OS up to 16 years of service life with the final year being Azure only. Even so, occasionally security updates can be released for an OS after EOL retirement if the vulnerability is deemed serious enough. There might have also been some remaining patches. I would not expect there to be another year of patches if no further ESUs are offered.
An example of such an out of retirement update for Windows XP:
Listing | Start Date | Mainstream End Date | Extended End Date |
---|---|---|---|
Windows Server 2008 | May 6, 2008 | Jan 13, 2015 | Jan 14, 2020 |
Releases Expand table| Version | Start Date | End Date | | :--- | --- | --- | | Extended Security Update Year 4 (Azure only) | Jan 11, 2023 | Jan 9, 2024 | | Extended Security Update Year 3 | Jan 12, 2022 | Jan 10, 2023 | | Extended Security Update Year 2 | Jan 13, 2021 | Jan 11, 2022 | | Extended Security Update Year 1 | Jan 15, 2020 | Jan 12, 2021 | | Service Pack 2 | Apr 29, 2009 | Jan 14, 2020 | | Original Release | May 6, 2008 | Jul 12, 2011 |