I don't think you are correct here - pkg upgrade most certainly pulls down updated versions of packages, complete with security patches. In fact, the default freebsd daily job will send you an email listing which packages have security vulnerabilities, so you can go update them.