Yes, plugin updates replace the whole plugin with the updated version. Version 1.1 of a plugin would typically include all changes made in previous versions. You cannot selectively apply changes from various versions.
Additionally, the only way to know whether a plugin update includes security fixes is to read its changelog. Often updates will include security fixes and UI updates, so identifying specific updates as UI or security updates is often not possible.
If a plugin has a version 1.0, then makes a version 2.0 with major changes that are not compatible with your site in some way, and then releases a 2.0.1 update with important security fixes, you will not be able to apply those security fixes to your 1.0 install. Those fixes may not even be required for the old version, but the only way to know that is to check the changelog and ask the developer. In cases like this developers may choose to release a 1.0.1 update that applies just the security fixes, but if they do the WordPress dashboard will only let you update to 2.0.1. In a case like this you would need to follow the developer’s instructions to update to the lower version.
I strongly recommend that you keep plugins up-to-date and just adapt to any UI changes they make, regardless of whether the updates are security or feature updates. If you don’t you may find yourself unable to apply important security updates.