The business I work for just finished a mass computer replacement project. All of the old computers were seven year old Ivy Bridge systems, most of them still running Windows 7 (EOL for Win7 is part of what prompted this replacement...ironically, the at-the-time impending EOL for WinXP is also what prompted us to originally buy those Ivy Bridge systems seven years ago). I can certainly understand the "why get rid of something that still works" sentiment. With a good dust eviction, some SSD and RAM upgrades, plus the (thanks to the still-existent loophole) free update to Windows 10, these systems could have continued to function perfectly fine for general office tasks, and possibly even run some of the new software that was scheduled to coincide with this replacement project.
However, upper management decided to take the "even if we upgrade the current systems, their age means they could still die at any time" stance, and I can certainly understand that line of thinking as well. Doing this replacement did also provide the opportunity to switch to a smaller form factor system that takes up less desk space and conceivably uses less power. A change in software service providers was also scheduled to happen at the same time, and it's possible that there may be hardware requirements I'm not aware of that necessitated all new computers (I was involved only in the physical setup of the computers, not installation of the software itself). As for the old systems, I've been told to DBAN the hard drives then take them for recycling. The recycling center here has a storefront where they can sell used/recycled computers to the general public, so fortunately when I take them there, it is almost a certainty they'll be resold.
As for the three-year replacement cycle...as already mentioned, a lot of places lease their computers, which means they are contractually obligated to replace them on a predetermined schedule. I agree, depending on the reputation of the company repossessing the computers at the end of the lease period, there is always a risk of data breach. The business I work for doesn't lease, but if we ever were to do so, I would be proactive about making sure the hard drives are totally wiped before returning any computers, rather than simply trusting the company managing the lease to do so themselves. As for what would happen to the computers themselves afterwards, that would unfortunately be out of my hands, but I would hope they are resold.