There are no known security vulnerabilities in 2.9.2
If any new vulnerabilities are discovered the fix will be packported. (This has not happened but if it did we would get a version 2.9.3)
WordPress does not have a backport policy that goes further than the previous major release so it is unknown when the 2.9 branch will stop being supported.
WordPress does not maintain lts versions. Matt likes to call them Long Term Suckage and most in the community agree that there is really no reason to keep running out dated versions.