An alternative to replacing the drive inside the iMac would be to attach an SSD to the Thunderbolt port. OS X and the Mac firmware don't really care if a drive is external or internal in most cases for booting.
On the OS patch side, Apple sees it more based on what hardware they are dropping support for. The security patch released this week runs on all the hardware that was capable of installing OS X 10.8. The minimum hardware requirements for the OS are identical between 10.8 through 10.11. Hardware cutoffs tend to start at 5 years old, Apple's transition to vintage. It's almost certain the hardware will see a loss of OS support/patches by the time it hits obsolete at 7 years.
https://support.apple.com/en-us/HT201624In Windows terms, it's similar to how Microsoft doesn't release updates for Windows 8 anymore, however they do for the new OS they released a year later, 8.1. Any machine capable of running 8 is capable of running 8.1. Just as any Mac capable of running 10.8 is capable of running 10.11.