Ever changing life cycle process
Service Packs for Microsoft products, at the time, were provided with 12-24 months of support depending on the product after the release of the next service pack.
For Exchange Server 2013, the SP1 is caught in an awkward state of support perpetuity until Exchange 2013 itself hits the end of support lifecycle as there was never a “next service pack” released due to the change to only issuing CUs. Since it’s still technically ‘supported’ Microsoft has to create security updates for Exchange Server 2013 SP1. It was kind of a necessary evil to transition to the CU supported/servicing model. Now you see MSFT products moving away from the “Fixed Lifecycle Policy” to the “Modern Lifecycle Policy”. This new modern life cycle policy allows a more agile, ongoing updating process across all Microsoft products.
If you have a question about a specific application or operating system, please reference that products life cycle page as there could be changes depending on different options.