In reply to Amir.

I think the challenge with security issues is trying to balance end user security-related safety versus breaking their site. It's almost a catch 22 issue since from a security perspective a secure broken site is better than a functioning site with security issues. Unfortunately it's hard, as a plugin, to have that sort of conversation with a user, and as you stated, user's don't actually care why their site broke even if it is a good thing. Security is hard and I don't see there being an all encompassing answer.

Also, how can WordPress release the pending changes to developers only, without risking nefarious people getting that information also and using it to attack sites before the security fixes are publicly available?