I'd veen wondering whether it couldn't even be taken a step further & a standard form of formatting (a shouty caps lock prefix to the line perhaps stating 'SECURITY FIX'?) a requirement, to make it absolutely clear for all users when one's included. A formatting standard could potentially go further of course, to also have 'Bug Fix' & 'New Feature' prefixes, but the security fixes are by far the most important.