Apple - What is Apple's policy for supporting security updates on older versions of iOS?
Unlike for Mac OS X, Apple does not release "Security Updates" for previous versions of iOS after the next major version has been released, unless it is an extremely major vulnerability. Simply put, you are required to upgrade to the newest version if you want all security fixes.
As an example, once iOS 10 is presumably released later in 2016, there should be no expectation of security fixes for iOS 9 (whatever the last version will be).
For iOS 6 specifically, the last general release was iOS 6.1.3. iOS 6.1.4 and 6.1.5 were specific bug fixes for certain devices. iOS 6.1.6 was released in February 2014, to provide a security fix (goto fail) for iPhone 3GS and iPod touch (4th generation) devices. That was well into the support period of iOS 7, and was only released due to the severity of the issue.
Other than iOS 6.1.6, there have been no security updates issued for old versions of iOS after a newer major version has been released.
References: Apple Security Updates, iOS Version History
Apple released security fixes for iOS 9 & 10 on July 22, 2019.
- https://support.apple.com/kb/HT201222
iOS 10.3.4 for iPhone 5, iPad (4th generation) Wi-Fi + Cellular
iOS 9.3.6 for iPhone 4s, iPad mini (1st generation) Wi-Fi + Cellular, iPad 2 Wi-Fi + Cellular, iPad (3rd generation) Wi-Fi + Cellular
Apple hasn't announced a security update policy, but owners of older iPhones should have some peace-of-mind on this.