The following is an excerpt from
How Android devices receive security fixes?
The manufacturer of each device is responsible for distributing software upgrades for it, including security fixes. Many devices will update themselves automatically with software downloaded "over the air", while some devices require the user to upgrade them manually.
Google provides software updates for a number of Android devices, including the Nexus series of devices, using an "over the air" (OTA) update. These updates may include security fixes as well as new features.
If your worried about vulnerabilities in Android, you should be running the latest update on your device. Which would be KitKat, until L (lemon) is released across the board.
Remain conscientious when using your device.
Although I found evidence alluding to supported versions of Android, nothing was conclusive. It seems Gingerbread and up will continue to receive updates. Gingerbread is still being released on new devices, so development isn't discontinued.