How to know which security updates to install?
Part of my mistake was in comparing QFE and GDR builds and release dates.  The QFE downloads are much larger (~600 MB) than the GDR downloads (~200 MB).  The dates and build numbers vary widely as well

I found the information at Latest Builds of SQL Server 2014 quite helpful.  So just comparing the related security bulletins and GDR releases:

ms14-044 gdr = 183 MB   build 2254  8/12/2014
ms15-058 gdr = 205 MB   build 2269  7/13/2015


The one released on the later date is the higher version.  I'm not yet sure how the person that maintains the page deduced that build 2269 includes the fixes from build 2254, so perhaps someone can comment on that or edit this answer.