In reply to Rony.

I can totally see where the email seemed out of the blue.

I opened a Core Trac ticket to explore adding some additional context to those emails for the case of a forced security update: https://core.trac.wordpress.org/ticket/53337#ticket