Regarding the concept of a WordPress Threat Level - This is something really hard to define.

It is rare that a security fix is so cut and dry that you can make one of these level based statements - and if you do prepare to be shown by the ingenuity of the crackers themselves that you were wrong - it is very hard to identify all the ways in which a security bug that is fixed can be exploited!