Since WordPress 5 is out im wondering if there are still security updates for WordPress 4.9.9 or do I need to update to WordPress 5 as soon as possible?
According to Codex:
The only current officially supported version is WordPress 5.0.3. Previous major releases before this may or may not get security updates as serious exploits are discovered.
So, as you can see, the official version is that only the newest version is supported and only that version guarantees that you'll get security updates.
But if you'll see at history, most of the times, previous version also gets security updates.
On the other hand, if you want to postpone this update because of Gutenberg (Block Editor), then you can always use this question and disable it: How to disable Gutenberg editor?