It is not a given that an older version will be unpatched. For example, RHEL (and by extension CentOS) backports patches without updating the version number.