Apple does not backport all security fixes and they never have, and what they do backport they do on a delayed schedule. It's not clear whether they have an actual policy that determines what gets backported or whether it's just a judgment call, but the consequence is that indeed on any Apple device the most secure OS is the current OS.
They will however backport fixes for particularly egregious security issues quite far. For example, iOS 12 got a fix for a web-based remote code execution attack in the beginning of this year, despite at that point being over 4 years old and 4 major releases older than the current iOS.