They have been pretty good about doing that. There was a security patch for Rails 2.3.x 6 days ago: http://weblog.rubyonrails.org/2011/6/8/ann-rails-2-3-12-has-...

It's not just security (and other) patches for Rails, it's maintenance for the assorted plugins one inevitably ends up using.

If you've a Rails 2.x app with plugin ActsLikeWhatever, and you run into some problem with that plugin, chances are the fix will only be in the newest, non-Rails2, release.

Support for 2.3 will be dropped as soon as 3.1 is out.