Are security patches only applied to the latest Android version?
Google provides security updates for older AOSP major versions, but they do not provide updates for Pixel phones.
You can see this easily in the list of available Firmware images for Pixel devices:
Take for example the Pixel 3a:

The available Android 9 releases are dated from March 2019 to August 2019
The available Android 10 releases are dated from September 2019 to August 2020
The available Android 11 releases are dated from September 2020 to October 2020 (now)

As these are all factory images available for the Pixel 3a you can see that there are no (security) updates for Android 9 based images after Android 10 has been released and the same is true for Android 10 which stops after Android 11 has been released.
The provided images are not OTA updates received by regular bootloader locked devices, but I would assume that Google does provide the same versions as full firmware images and OTA updates.