Is 8.6.18 insecure? Will there be 8.6.19 etc.? I have a custom module that I think requires Drupal 8.6.x.

Is Drupal core 8.6.18 insecure? Will more 8.6.x versions be released?
According to the Drupal core release cycle documentation, the last month for security coverage for 8.6 was November 2019. There is no more planned security coverage for 8.6.

Security releases only last through the next minor release cycle. I.e. 1.0 will receive patch and security releases until 1.1 is released. Then 1.0 will continue to receive security coverage until 1.2 is released. Once 1.2 is released (the second minor release since 1.0), 1.0 is considered unsupported.