While the usefulness of admin notices is up for debate, I think the chances of the average user seeing the note in the changelog or long description before it is permanently removed, when they already have the plugin installed, is slim.

Perhaps a Security Notices submenu item under Dashboard? It can highlight plugins with no updates for a certain time (though that's not a defining factor in whether its a security risk) along with plugins that have known vulnerabilities.

This way the number of issues can be noticed with a red indicator within the submenu item title (and combine with the normal number of updates in the parent Dashboard menu item). If wp.org volunteers have additional information (such as a patch located elsewhere) they could also list it there.

From the comments on that old wp.org feature suggestion it looks like a lot of the above is being considered, so worth a vote :)