I'd have to say that we do see security patches for SQL Server these days, and they certainly require more work for me than service packs.

SP# > current SP, install it.

MS12-070 - well, what's your current build number? And if Microsoft Updates installed the one for the lesser build number, you can't upgrade to the greater build number (or at least I haven't figured out to go from build 10.00.5512 to 10.00.5826 without getting stopped by a "you've already installed this update" error)

Last year, SQL Server 2005 had two security updates (MS12-070, MS11-049) and no service packs.

2008 had one security update (MS12-070), no service packs.

2008R2 had one security update (MS12-070), one service pack

2012 had one security update (MS12-070) and one service pack.

Sum total: two service packs, five security updates.