The bionic repository will contain original code, eg. using linux-generic
as an example, you can find
linux-generic | 4.15.0.20.23 | bionic | amd64, arm64, armhf, i386, ppc64el, s390x
which is what you'll find on Ubuntu 18.04 initial LTS ISOs.
(Ubuntu 18.04.1 & later ISOs include packages from bionic-updates as of the time of ISO creation, thus 18.04.1 may have newer packages than initial 18.04 ISO, but not as modern as say 18.04.2 etc)
The bionic-updates repository will have the updated code, ie.
linux-generic | 4.15.0.206.189 | bionic-updates | amd64, arm64, armhf, i386, ppc64el, s390x
I've used the following to get my detail (note: I removed non bionic lines)
guiverc@d7050-next:/de2900/lubuntu_64$ rmadison linux-generic
..
linux-generic | 4.15.0.20.23 | bionic | amd64, arm64, armhf, i386, ppc64el, s390x
linux-generic | 4.15.0.206.189 | bionic-security | amd64, arm64, armhf, i386, ppc64el, s390x
linux-generic | 4.15.0.206.189 | bionic-updates | amd64, arm64, armhf, i386, ppc64el, s390x
linux-generic | 4.15.0.208.191 | bionic-proposed | amd64, arm64, armhf, i386, ppc64el, s390x
I'm not sure I'd use the word stable or secure as in your question; there are more fixes including security fixes in the -updates or -security repositories.