It absolutely includes security issues, across the entire EU and EEA btw.

(Though in most EU/EEA countries you only get 2 years, which is why phones now get 36 months of security updates if they're on sale for 12 months).