What is the lifecycle of Oracle Linux for minor releases?

Oracle's lifecycle for Oracle Linux is only at the major release level, not the minor. (see here: https://www.oracle.com/a/ocom/docs/elsp-lifetime-069338.pdf) The important part of the version for software compatibility is the "7", not the ".x". Oracle Linux 7.8 just as a newer kernel than 7.7; they're not "separate" releases.

If you need to maintain security, then you need to install kernel patches as they are released. Particular kernel patches will automatically increase the point release of the Oracle Linux OS; the point version is an indicator of the minimum kernel version. This happens once or twice a year in my experience.

I've never seen software that had an issue with that - that wouldn't release its own update to support a new kernel version if necessary. If you have to freeze the kernel version to support something specific, then by definition security isn't really critical - I don't think you can have it both ways.