I have JDK 8u60 installed. I checked the Oracle website today and they have released two versions simultaneously: 8u65 and 8u66. Both are public release versions.
From the download page (emphasis added):
Java SE 8u65 includes important security fixes. Oracle strongly recommends that all Java SE 8 users upgrade to this release. Java SE 8u66 is a patch-set update, including all of 8u65 plus additional features (described in the release notes).
Oracle often does this. It's all about how you as a customer want to handle the risks.
Users should only use the corresponding PSU release if they are being impacted by one of the additional bugs fixed in that version as noted in the release notes.
8u65 has security fixes and sets a new security "baseline" for companies to achieve Java 8 applications. 8u66 has those same security updates, plus additional bug fixes. However, even bug fixes can sometimes cause changes to behaviour that present compatibility issues for users. Thus the changes in 8u66 are optional (note that the baseline linked above is still 1.8.0_65, and companies that want more stability in their platform might well prefer to only apply the security fixes, which are necessary.
Oracle is certainly not obligated to split their updates in this fashion, but I'm sure some of their most risk-averse customers are glad to have the option.