Sadly not updating the OS is very bad from a security perspective. Though it's frustrating that Apple rarely provides any sort of "security fix only" updates, and to fix security issues you just have to install all the new things at once.
Sadly not updating the OS is very bad from a security perspective. Though it's frustrating that Apple rarely provides any sort of "security fix only" updates, and to fix security issues you just have to install all the new things at once.
My experience has been that they do provide those updates, but they intentionally make it hard to notice compared to getting the major version updates that are available for the OS. I distinctly remember a new junior engineer out of college joining my team back in maybe 2022, seeing there were security updates, and then not noticing the button saying something like "more updates" to be able to get them without updating to the latest major version of MacOS.
More recently, at the end of August, by the dates on my screenshots on my work laptop (the only Apple device I use) I took screenshots because I was incredulous of the sheer audacity of the UI shown for updating from MacOS 15.7.7 to 15.7.9 along with, in the words of the update UI, "1 more" update. When I clicked the button to view all of the available updates, it showed three available updates, which were, in order, MacOS 26.6.2 (which was checked), MacOS 15.7.9 (which was unchecked), and Safari 26.6.1 (which was checked). They literally previewed the only update that was not checked despite not even sorting it at the top of the list of updates available to install. I have absolutely no clue what would have happened if I clicked the "Update now" button next to the prompt for 15.7.9 rather than the identically-styled-to-non-link-element text for viewing the full set of updates, but at absolute best it would have just done something entirely different than what I'd get from the default options when viewing the expanded list, and it seems far more likely that it would have just also done the default options of the expanded view and updated to a completely different version that it put next to the update button.
on MacOS they provide security fixes for two years for unsupported OSes (after that the only remaining security protection is Gatekeeper/Notarization). On iOS you generally get no security fixes unless the vulnerability is really bad
I recently sold a nine year old iPad running iOS 17 that is still getting security updates (17.7.11 a few months ago). Even iOS 15 (released 2021) got a security update in May.
I believe if you have a much older iDevice that no longer supports the latest OS, they will keep releasing security updates for that device for a long time, which is good on them. But if you have a newer device, after awhile the only way to get security updates is a major version upgrade. You luck out if your device happens to be old enough not support to newer iOS versions.