The kernel in Debian9 was updated by upstream and new updates, among regular bugfixes contain fixes for security issues:
https://metadata.ftp-master.debian.org/changelogs//main/l/linux/linux_4.9.189-3_changelog
The kernel was also included into just oldstable (compared to oldstable-proposed-updates). I'm not dropping oldstable-proposed-updates repository for now, since maybe we might need it once again in the future.