In reply to Carlos Araya.

Both plugins and themes on WordPress.org must be GPL or compatible with the GPL. So, you could have a theme with the GPL but include assets that are licensed under something like MIT, which is compatible. That's always been the case (I was on the theme review team and a team lead for several years, so we dealt with licensing almost daily). Even in the post you linked to, it specifically states, "We will only promote and host things on WordPress.org that are 100% GPL or compatible." Maybe it was just a misunderstanding.

As for updates and security, WP auto-updates are based on the branch. So, if you're on version 4.9.2, for example, you will be automatically updated to 4.9.3. For manual, one-click updates, it would offer you to upgrade 5.x.x or whatever the latest is. With that said, this should change later this year when auto-updates roll out for major versions. Anyone from that version (5.5 or 5.6?) forward, unless disabled, will get the most recent version.