Do Windows updates include security updates as well?
I.e. if I manually download Windows updates does this mean that my Windows will be up-to-date in security vulnerabilities as well, or there is a different download method?
Windows Updates do include the security updates. That's the main point of the process.
As long as you're sure you don't miss any, you can download and install each update individually from Microsoft by hand, without ever running Windows Update, and have a fully-patched system. With over 100 updates for xp sp3 and 82 the last time I re-installed windows 7, it's way easier to just let Windows Update handle this.
It's also a much better idea to allow windows update to apply these automatically than to risk that you neglect to check for new updates for a while, thereby ending up unprotected. If you do really want to try doing this manually, it's worth remembering that Microsoft releases new updates on the 2nd Tuesday of each month (the next one is just 4 days from now). There have been occasions where a vulnerability was important enough to break the monthly patch cycle and release early. In these situations, you don't want to be the one left out in the cold because you do it manually.
As with many questions, the answer is "it depends".
Windows XP: If you set windows to download windows updates, you'll get security updates and bug fixes for Windows.
If you visit the windows update website you'll be able to see not just security updates but optional updates and enhancements and some driver updates.
When you visit the windows update site you'll also have an option to install Microsoft Update which allows the site to search for and provide updates for other microsoft software such as office, visual studio, etc.
Windows 7: Windows update is now built into the OS more firmly. There's not really a windows update site you visit and the system already updates not just the OS but other microsoft software and a broader range of drivers and even a few non-microsoft software products.
It also, by default, includes non-security patches in the automatic update process, though you can choose whether or not to install these.