As far as I'm informed, it's the second type only. You can't even fetch specific package versions (Pacman keeps old packages around if you ever need to downgrade to a previously installed version, but that's it). Of course, I could be missing something there :)

So yeah, you probably won't be using it for a web server or the like, but I wouldn't imply from that that Arch is to insecure to use as a dev machine.

As far as bugs go: There's a testing phase/repo for new packages, so it's not really likely that an upgrade will do much damage (and as I said, you can still downgrade if necessary).

Rolling release distros are based on the assumption that it's more important to get bug fixes out fast than wait to see if a new version introduces new bugs. As long as you update your Arch install as frequently as possible AND iron out any small problems that occur (like config file changes) right away, it's actually pretty secure and stable. You'll get new bugs but they'll usually get fixed before they can do much more than cause a minor inconvenience.

If you fall off the update treadmill, you start running into problems, and they tend to be weird problems that are hard to reproduce because so few people are running the exact combination of package versions that you are. Usually a full update fixes things, but the longer you've missed updates for, the more likely something will get FUBAR during the update process.

Maybe a simpler way to look at it is that rolling release distros trade slow-moving versions with low quality variance for rapid updates with high variance. Any given snapshot of Arch package versions is going to have problems, but you also don't sit on that particular combination of package versions for long. As a user you just have to decide whether that tradeoff is worth it.

Arch Linux doesn't have 'security patches only' option because they exist for older versions. All updates are just updates. You can however restrict a particular package from being upgraded and manually update it.