In practise yes
There was a XSS bug (XSS vulnerability was discovered in the Flash fallback files in MediaElement), affecting all versions since WordPress 3.7 (at the point where it was discovered, of course).
Wordpress team fixed it, and released version 4.9.2 to fix it on the 4.9 branch. It also released version 4.8.5, 4.7.9, 4.6.10, 4.5.13, 4.4.14, 4.3.15, 4.2.19, 4.1.22, 4.0.22, 3.9.23, 3.8.25 and 3.7.25 to fix the respective branches.
You can easily view the changes and see that they are backports covering this same issue.
So, as far as you update to a newer release of those "old versions", you would be fine... if there are patches.
Now, what you need is to stay at a version for which someone (preferably Wordpress team) will issue a fix if there a new vulnerability affecting it was discovered. This is documented on
And there they say:
The only current officially supported version is WordPress 4.9.1. Previous major releases before this may or may not get security updates as serious exploits are discovered.
WordPress will be backported security updates when possible, but there are no guarantee and no timeframe for older releases. There are no fixed period of support nor Long Term Support (LTS) version such as Ubuntu's. None of these are safe to use, except the latest series, which is actively maintained.
So, they give no warranties that they will continue doing so in the future, but are fixing the security bugs (no new features, of course). Regarding version 4.7.9 note that Debian stable wordpress package also uses the 4.7 series and this branch is likely to continue receiving security fixes (by both wordpress team and downstream maintainers) for quite a long time.
Given this, I wouldn't consider requiring that the webmaster updates to 4.9.2 if they are already at 4.7.9, as the security issues have been fixed. They are updating their wordpress. The lazy webmasters are those that installed 4.3.5, and are still running that version.