Cisco does separate releases into two groups: Technology ("T") Train which includes new features. And "mainline" which includes only bug fixes.
You can open a TAC case w/o a support contract, provided your equipment is under warranty. Our company does so on new equipment, before it is added to the contact (annual renewal). To do this, you must call them.
Cisco doesn't charge for software updates that based on security vulnerabilities. (If you don't have a contract, you must call them.)
Writing this from memory, since I'm too lazy to look up the references.