That is "upstream" support, so yes, PHP themselves will no longer be providing updates for PHP7.0. But that doesn't mean that it won't be supported. TurnKey doesn't install PHP7.0 direct from PHP, we use the Debian packages, so that "EOL" doesn't really apply.

The Debian security team currently provide backported security updates for PHP7.0 (and almost all packages in "main"). The security team support will continue for Debian 9/Stretch (the basis of TKL v15.x) for one full year after the current Debian "testing" (10/Buster) is released as "stable" (expected mid 2019). Security team support will continue almost certainly until some time in 2020 - so at least another year. Even after that, Debian support will continue. Once the "Security team support" finishes, the responsibility of maintenance of PHP7.0 (and other packages) on Debian 9/Stretch will move to the the LTS team and support will continue until June 2022.

FWIW whilst this may seem a little strange if you are coming from a Windows environment, it is quite common in the Linux world. It is one of the awesome benefits of opensource, anyone can maintain it if they wish! And having specific versions maintained for extended period of time is one of the many reasons that Linux is known to be so stable and such a great choice for a server. So Debian won't be working alone on maintaining the security updates. They will be working with other teams from other distros such as Ubuntu (16.04 also includes PHP7.0 and will be supported until 2021) and others such as SUSE and Red Hat, etc.

Having said all that, we do have plans to support users to select alternate versions of PHP (namely 7.2) on TurnKey v15.x at some point in the future. Although they won't be official Debian packages, so won't have automated security updates. If you're interested in that, then please let me know and I'm happy to share my recommendations on how to do that manually (when we do provide it, it will be "TurnKey"! :)