Do SQL Server Compatibility Levels Introduce Old Security Vulnerabilities
It does not introduce past vulnerabilities, and applies mostly to T-SQL syntax and T-SQL features. As the documentation states, 


  Compatibility level affects behaviors only for the specified
  database, not for the entire server. Compatibility level provides only
  partial backward compatibility with earlier versions of SQL Server.


Later on the documentation goes on to list the differences between each mode and you'll see no mention of security or hotfixes, just features/behaviors that will be differently implemented or unavailable. 

Exploits would generally be at the server and DB engine level, so that isn't really a concern here. It would be a pretty huge security risk if I always kept my MSSQL instances patched but had one database in an older mode that was never able to take advantage of my diligent patching efforts. Although that would be a great way to get people onto the newest version!

You could argue that using old T-SQL code constrained by old version syntax might cause one to use work-arounds to inelegantly achieve certain requirements, which in turn might cause code to be more at risk for having vulnerabilities, but that onus is on the developer and nothing inherent to MSSQL. I can't even think of an example where this applies, but I'm sure they exist.