He had enabled a setting that says "Install [...] security updates". If enabling that setting does not lead to the system installing security updates, that's on Apple.
System updates also include security fixes.
System updates also include security fixes.