Do old versions of Android still get security patches? For example if a critical vulnerability is found in Jelly Bean would it get a patch, or is the expectation that users should upgrade to KitKat to be more secure?

Does Android even have the concept of individual/incremental security patches, or are Maintenance Releases (MR) the only way to get patches?

I found a comment here, but would like confirmation (with source if possible)...

https://android.stackexchange.com/questions/83852/which-versions-of-android-is-google-developing-security-fixes-for
It is generally expected that users would upgrade to the highest version of Android available to them, so Google do not release updates to previous firmware versions. However, Samsung occasionally release security updates independently of Google to older models. It's also worth noting that a number of security issues are within apps and not Android itself, which the user is able to update via the Play Store.