That's bollocks. Bookworm has received 11 point release updates, and they were definitely not only security updates. Read through the the 12.1 release notes, for example. "Fix playing of custom alarm sounds" does not sound like a security fix, nor a severe issue.
Security updates are released frequently, often just days apart, to individual packages. https://www.debian.org/security/
Point release updates (12.1, 12.2, up to 12.11) are released several months apart. They are thoroughly tested and verified to work together.