Overall, I think WP security has performed extremely well in addressing discovered vulnerabilities in a timely manner. I can speak to the often difficult balancing act of the process involved. Moreover, it can be a thankless job as I am sure @nacin and others will attest to.

But it's the responsible reporting of discovered vulnerabilities by pro's and novices alike that help keep the code safely updated for use. Everyone who works the process responsibly should stop for a second and give a virtual high five and group hug, and recognize how much you matter to the success of so many.