What is Apple's policy for supporting security updates on older versions of iOS?
Unlike for Mac OS X, Apple does not release "Security Updates" for previous versions of iOS after the next major version has been released, unless it is an extremely major vulnerability. Simply put, you are required to upgrade to the newest version if you want all security fixes.

As an example, once iOS 10 is presumably released later in 2016, there should be no expectation of security fixes for iOS 9 (whatever the last version will be).

For iOS 6 specifically, the last general release was iOS 6.1.3. iOS 6.1.4 and 6.1.5 were specific bug fixes for certain devices. iOS 6.1.6 was released in February 2014, to provide a security fix (goto fail) for iPhone 3GS and iPod touch (4th generation) devices. That was well into the support period of iOS 7, and was only released due to the severity of the issue.

Other than iOS 6.1.6, there have been no security updates issued for old versions of iOS after a newer major version has been released.

References: Apple Security Updates, iOS Version History