https://docs.silverstripe.org/en/3.3/contributing/release_process/#supported-versions states that "Security fixes will be applied to the current master and the previous two major releases (e.g. 4.0, 3.2 and 3.1).". Since SS moved to semver in the middle of version numbers, this statement is not very clear. The previous two major releases would be 2.x and 3.x in semver, whereas in SS it actually means something like ~3.2 (semver) and 3.1 (non-semver).
When was 3.0's end-of-life actually declared? Or when "did it happen"? I think it would have been good to officially retire that version, especially since it didn't follow semver yet. The same applies to 3.1 once it's time for it to go.
Hey Florian, sorry for the radio silence on this - we've been discussing a more defined (and predictable) release support policy with the core committers group for the last few weeks, please watch out for an announcement about this on the mailinglist soon.