Kitkat has been around for almost 5 years, so it’s already been receiving security patches by Google for twice as long as Jelly Bean. Unfortunately it is not predictable when Google stops supporting Kitkat (and of course Google releasing security patches doesn’t mean that they arrive on the FP1).
Two other aspects:
- When Google stops support for an Android version, it doesn’t mean that developers stop supporting that API level in their apps right away.
- I have the impression that #dic:floss developers in general try to support older Android versions than their proprietary counterparts.