The LXD maintainers are indeed paid by Canonical and we’ve been making LTS releases of LXD every 2 years with a commitment of 5 years of upstream support. This matches what we were doing upstream around LXC and LXCFS prior to LXD being a thing.
As we’ve now done 4 of those for LXC/LXCFS and 3 of those for LXD, I think we have a pretty good track record on this.
Canonical may be extending things even further for Ubuntu users through things like ESM, but that’s separate from the point releases and security support we’re doing upstream.