Do I need to install SQL Server service packs to continue receiving security patches
It's always been my belief that SQL Server needs to be updated to the latest service pack in a timely (and tested) manner to continue receiving security/bug patches.


You are correct. Some service packs will continue to have new CUs until their lifetime runs out.


  ... and that it would automatically recieve security patches any way.


They either didn't understand how this worked or flat out lied to you.


  Is this the case, or do you need to keep up-to-date (once tested) with the latest service pack?


You'll need the latest SP + Patches. For example, since you're on RTM... you're missing quite a few different security patches because they weren't made for the RTM branch after it went out of support*.

*Note that the links above show the same security updates released for supported service packs at the time. However, RTM was not one of them.