As long as possible unless nobody uses it for cases that need any security (daily driver, server, enterprise etc). If you drop support, you are lazy and support ewaste creation. In some cases it can be too difficult to support it but “too difficult” has a lot of meanings most of which are wrong.
I think for me, a 10 year minimum seems reasonable.
That’s really not enough. GTX 1080 is an almost 10 years old card but it’s still very competitive. Most of my friends even use 750s or similar age hardware. And for software, any major updates just make it more enshittificated now lol.