This is just a misunderstanding of how brew works. Brew is doing what it is designed to do. Your assumptions are that brew should be able to "pin" a package to an exact version, or that it is selecting packages at random to upgrade, but those assumptions are wrong.
However brew does support your use case, but it take some extra effort. If you want to use brew to install an exact version of python you need to create a tap: https://docs.brew.sh/How-to-Create-and-Maintain-a-Tap
Also, you aren't forced to use brew to install that version of python. You can do so yourself using the standard make; make install. It would be best to install it under /opt. Or use any other available method of installing software on your mac.
https://docs.brew.sh/FAQ#why-does-brew-upgrade-formula-also-...
However brew does support your use case, but it take some extra effort. If you want to use brew to install an exact version of python you need to create a tap: https://docs.brew.sh/How-to-Create-and-Maintain-a-Tap
Also, you aren't forced to use brew to install that version of python. You can do so yourself using the standard make; make install. It would be best to install it under /opt. Or use any other available method of installing software on your mac.