They could keep it alive past five years if they really wanted, but that goes against the goal of the project: namely security. But five years is already longer than most manufacturers do, so it’s nothing to turn your nose up at.

“GrapheneOS aims to provide reasonably private and secure devices. It cannot do that once device support code like firmware, kernel and vendor code is no longer actively maintained. Even if the community was prepared to take over maintenance of the open source code and to replace the rest, firmware would present a major issue, and the community has never been active or interested enough in device support to consider attempting this. Unlike many other platforms, GrapheneOS has a much higher minimum standard than simply having devices fully functional, as they also need to provide the expected level of security.”

https://grapheneos.org/faq#legacy-devices