It's always been possible to stay on the previous year's release and continue to receive the security point updates. Indeed, over the past few months it's been possible to update from 18.6 to 18.7 (when 26.0 was released) and then receive 18.7.1 and 18.7.2 despite 26.1 having been released.
In fact, right now iPadOS 18.7.3 is available to iPads that can run iPadOS 26, but for some reason iPhones don't have iOS 18.7.3 available if they can run iOS 26 - so it seems like a mistake. Supporting this theory, if you enable the iOS 18 beta track, iOS 18.7.3 then becomes available again.