I can't remember the specifics, their public documentation is a bit squirrely about what they do and don't support as well. "Common" software like MariaDB, PostgreSQL, PHP, etc, usually got ok-ish support. Anything outside of those common packages was out of scope, so if you were using, let's say something uncommon like quagga on 14.04, that more than likely wouldn't get any kind of support. (Not that I'd expect any support since Quagga has been dead since around 2017-2018, just using it as an example.).

Who knows what unreported CVEs nation states are holding close to their chest for customers who purchase support options like this. It's much easier to find CVEs in older software that didn't have as much security awareness as we do now. It's a reason why I consider these excessively long support contracts to be reckless and dangerous.

The TL;DR: Don't purchase their extended support options unless you fit into their guaranteed supported software model, and even then I'd be extremely wary.