Catalina is not a security update.
Relatively unsurprising, considering that the developer of Little Flocker now works for Apple.
Not having that functionality was dangerous enough that someone wrote a very involved program called Little Flocker, which was valuable enough to be sold to F-Secure. Apple hired the author (although it is perhaps not directly attributable to Little Flocker, he was well known in Apple-related security circles prior) and in the next major OS rev after that hire, the functionality was included stock in the OS.
People running Catalina are at greatly reduced risk from common threats from malware.
It's absolutely a security update.
It's a "security update" in that it improves security, but it's not a "security update" in terms of preventing risk for exploits that have come out or become popular since the last patch.
When people talk about always installing security updates as soon as possible, they mean the latter.
I can ignore that, and install only security updates instead, but that is indeed the UI for the update to Catalina.