In reply to David Anderson.

Agree. That's one of the reasons we write these security notices. Most companies will not alert their users and will also try to downplay any security issues in the changelog.