Yes, unless they are using the v3.5.4 tag to keep themselves on 3.5.
The diagram on the homepage of https://releases.discourse.org/ is the best way to visualise things.
Whatever release stream you choose, you’ll always need to update regularly for critical security fixes. The question is whether you also want to pull in new features & other changes along with the security fixes (if so, use release or latest), or whether you prefer to have a 6-monthly-ish cadence for those (if so, use esr).
It’s still early days for this new numbering scheme, so the documentation & tooling will continue to evolve as we grow into the new system.