Trying to detect and mention if updates are security-related sounds like a good idea, but when it comes to plugins it is not. What we have seen over years of keeping track of vulnerabilities in plugins is that you won’t always know if an update fixes a security issue. Take the changelog for an update to the very popular File Manger from yesterday, which reads “Syntax checker feature removed for now”. Would anyone looking at that guess it is a reference to an exploitable vulnerability being fixed in the plugin, probably not. So you really need to keep all of your plugins up to date at all times instead of trying to prioritizing updating ones with security updates, incompletely mentioning that updates include security updates is likely to lead people thinking they can do otherwise.

It is important to note also that there are currently plugins with over 4+ millions installs that are known to be vulnerable, but haven’t been updated and still currently available to download through WordPress, so updating plugins won’t address a lot known security vulnerabilities in plugins.