What you seem to propose is a separate stream of updates and security fixes. For this to work the way you describe would mean the company releasing all security fixes for every revision of updates. That's a lot of work in testing, release management, and support, and I don't expect any small sized company to bother.

Actually, I don't know of any project that does this - you may get fixes for a number of supported releases, but the expectation is that you upgrade at some point, or its eol for your product.