In general, for maximum security, you always want to stay as updated as you can. Every new release aims to be more secure than before. If you have read about a security vulnerability in iPadOS 16, chances are the vulnerability is also there in 15.7 and a few more too. Not always, but generally. Apple has a new security blog detailing some of their security models and it's a fascinating and detailed read. They also have bug bounties, so if anyone finds security holes in any of Apple's operating systems, Apple will pay up to 3 million dollars for a report on the problem so they can fix it. Security is a big deal. Apple has also heavily marketed its privacy practices and if they were to be caught with their hands in the proverbial cookie jar it would not be a good look PR wise. As such they have a great incentive to be responsible with user data, and in general they are. User data collection is opt-in and anonymised if opted in.
In conclusion, you probably should keep upgrading your operating systems when new ones are available for maximum security.
However, it is important to remember that the system level security and privacy practices is only a very small aspect of privacy when the internet and web gets involved. Most websites will track you as much as they can, data brokers collaborate with various websites to collect data across a myriad of sites, gather it together and combine data on users for sale, and fingerprinting techniques allow them to probabilistically identify you even if there is no unique identifier available for them to track. Apple uses tracking prevention in Safari, but it is almost impossible not to be tracked on the web to some extent. Not by Apple and iPadOS, but by the websites you visit. For maximum tracking prevention one can use something like Tor, where your traffic passes a lot of intermediate layers but it is slow compared to normal browsing and a lot of websites will not function properly like this due to limiting their use of features like javaScript. It would also mean you shouldn't log into any web accounts since that also allows identification.
Attempting to prevent all tracking online in today's world almost requires extremist attention to detail and blocks most conveniences and platforms from use. However, if the goal is just to limit tracking, adblockers and Safari's built-in tracking prevention with the latest operating systems + iCloud Private Relay will filter out a fair bunch.
Security and privacy are two very distinct things however. For security, Apple platforms are generally very good. They are for privacy too, but while it is "easy" to avoid compromising security, relatively speaking, it is almost impossible not to have any of what is considered personal data "leaked" or collected. Regardless of platforms or system software
