Critical update patches on an Oracle SAP

Hi everyone. I'm fairly new to SAP, to please bear with me.

For normal Oracle databases, critical update patches are released every 3 months. I'm now on a client site and can see that they have not applied CPU patches to their SAP databases for over 2 years.

Reading up on Oracle's (typically opaque) patching notes, it looks as though SAP specific security patches (SBP) need to be applied.

Are these SBP patches applied instead of CPU patches? Or are these applied in addition to CPU patches?

Are CPU patches applied at all to SAP databases? And if so, are they applied in the standard way (as per non-SAP oracle databases)?

Any guidance, or (clear!) notes you can point me to would be greatly appreciated.

Many thanks