Every active release of Odoo - 7,8,9, MASTER and all the SAAS versions is being built several times a day as bug fixes (and security updates) are made.

http://runbot.odoo.com/ can tell you which fix(es) are being applied to the stable build.

I don't know of a build that is only updated for security patches.

I think it would be really important to have a more stable update path for Odoo 9, also it's quite confusing that the official download site mentions that "Odoo 9" is stable and the recommended version, but links to nightly builds (?!).

So I've opened an issue at

https://github.com/odoo/odoo/issues/11419

in the hope this will be addressed, best with a stable or testing repository for Debian, RPM and Arch based Linux distros...,-)

Dave

Ray is spot on here. You're best bet is to either pin the updates, alternatively use the github repository instead or just apply the new latest version once a month and test on a dev server beforehand. Odoo and OpenERP has always been this way.