Both URLs work. The server serves the same content at
The URL with
/debian-security has to exist because it's the only one that works with mirrors¹.
/debian-security is also required if you use FTP, or if you run a release that's no longer maintained and download from
I don't know why the shortcut without
/debian-security was created, but it's been mentioned in so many documents that you can count on it not to go away.
¹ Public mirrors are discouraged for debian-security, because security updates should be distributed as fast as possible. But private mirrors are useful for an organization that has many Debian machines.