What is the lowest iOS still being updated for security issues?

Generally speaking iOS updates do not work that way.

When Apple fixes security issues it updates iOS versions. There's no such thing as a security fix for a specific iOS version. It will update to a new version when it fixes something.

And except for very specific circumstances it usually does not update older iOS versions if there's a newer one available.

i.e iOS 7.1.2 was the last update for iOS 7. iOS 7 has gotten no further updates after 7.1.2, 10 months ago.

Correct. Though, since Safari cannot be updated on its own, if you have not updated your iPhone 4 to iOS 7.1.2 which is the last update an iPhone 4 can take, there are other security issues you should be worried about beyond Safari.

About the security content of iOS 7.1.2 - Apple Support