In reply to David Peralty.

All releases from 3.7 and up have had security fixes released and, by default, automatically applied.

Anything new now that indicates this will not continue, at least for 4.7 and the nearest releases before this one?