Today Microsoft confirmed that customers from Windows 7 Extended Security Updates (ESU) program will still get security updates, even when the operating system reaches End-of-Life. On an FAQ page, Microsoft answers that "Windows 7 ESU includes security updates for critical and important issues as defined by Microsoft Security Response Center (MSRC) for a maximum of three years after January 14, 2020. After January 14, 2020, if your PC is running Windows 7 and you have not purchased Extended Security Updates, the computer will no longer receive security updates."

This confirms Microsoft's intentions to support some customers who are unable to switch to more modern OS versions like Windows 10, presumably customers who can afford to pay for extended security on their machines. More info can be found on Microsoft's website for Security Essentials and FAQ about ESU for Windows 7.