CI 3.x Security

Is CI 3.x still being maintained for security updates and patches, I know CI 4.x is in full swing now but will CI 3.x app's not be patched if a vulnerability is found in CI 3.x or should it be considered a security risk to continue using it?

I believe ci 4 made more structural changes than security improvements. I believe that at the moment the CI3 is not risky. In any case, check the development in:
https://github.com/bcit-ci/CodeIgniter/commits/develop