Look at how @Debian does security announcements. Other distributions: Do it this way. https://lwn.net/Articles/899688/
You can get support for Debian beyond 5 years by paying for Extended LTS by Freexian https://deb.freexian.com/extended-lts/
Thanks to the @debian LTS team, all releases get 5 years of support. They are just now ending support for Debian 9 "Stretch" and beginning to support Debian 10 "Buster." https://wiki.debian.org/LTS/