When a major release is made, fixes are made to it, but it’s rare that fixes to older versions are made. It has happened before, but it should never be relied upon, and there are a lot of bugfixes that are never backported. Sometimes a version will be tagged before a major release that isn’t publicly announced, but these shouldn’t be used if you have the option of moving to the latest major release.
So current support paradigm is use the latest, or update
The release cycles also make no distinction between whole numbers. A new major release increments the version number by 0.1, 3.9 -> 4.0 is no more significant then 2.6 -> 2.7 other than by pure chance what the release contained.
An increment of 0.0.1 indicates bugfixes, security fixes may also be present in these releases
An increment of 0.0.0.1 indicates a critical fix, either for a security bug, or a silly mistake that has major repercussions.
Little testing is necessary when moving between point releases, only major releases should prove a problem. Well built code usually requires zero work to maintain from major release to release, and significant changes are pointed out in the release notes.
Any release could contain a security fix, only the very latest is guaranteed to have all the released fixes. Patches are rarely provided for older versions and use of older versions is actively discouraged