Core Contrib Modules and Security Modules

Are you supposed to apply changes to core-contrib modules? And if they have changes, do we have to apply them again when we preform a security update? 

Drupal version: 


Source: https://www.drupal.org/taxonomy/term/22/feed