On Friday (October 2nd) the downloadable CU that Microsoft publish as "the latest" (read only) update got moved to version 5.0.8308.933
There are some good updates in there for such things as high CPU usage on a topology publish and unable to join a meeting from iOS 9.
One of the confusing things is that the September security update still has the following text:
Now - leaving aside the copy and paste that has resulted in "Lync Server 2013" being on the line twice we have the confusion around should this be after the latest update (5.0.8308.933) or the latest update when the security article was first published (5.0.8308.920).
The security patch was actually 5.0.8308.927:
and as such versioning dictates that 5.0.8308.933 should contain all of the security goodness that was lacking in the July CU, and to find that out you have to drill deeper into the release notes 5.0.8308.933 of the web components server:
showing that yes - the latest CU does indeed contain the security update. Thus the only reason I can see for the security update to still be offered as its own download is if you are at the July (5.0.8308.920) CU (as that is a prerequisite) and do not want to move to the latest CU (5.0.8308.933) but do now want the security patch installing.....