How does “PHP Extended Support” work?

Some big providers like 1&1 or Stratos sell “PHP Extended Support” to their customers. These practices have caused – for good reason – a lot of controversy, but this is not the topic.

Do they have specialized teams for developing new security patches and fixes for the older deprecated versions of PHP? Or are there commercial external services one can purchase on the market? If so, do you know of enterprises providing that kind of service?

Most projects are easy to move forward to recent versions, I know. But I’m interested in the edge cases, where it’s just too much trouble and you want to keep the thing running for another year.