Are macos Mojave Security Updates Cumulative?
Yes, security updates are cumulative since the most recent point release. So, if you're downloading updates manually (to use with offline machines, or in some sort of automated deployment setup, etc), you'll want to install (1) the most recent &quot;combo update&quot; followed by (2) the most recent &quot;security update&quot;.
Frustratingly, I have been unable to find any official confirmation of this from Apple, but I am relatively confident this is how things work based on my own use. If you try to install an OS X 10.9.5 security update (like 2016-004) before updating from 10.9.4 to 10.9.5, the installer will complain and won't run. However, installing security update 2016-001 followed by 2016-004 seems to have the same affect as just installing 2016-004—you end up on the same build version.