In reply to Ryan Hellyer.

Rather confusing, isn't it? The document is on the WordPress.org About page under security and clearly states that it is about WordPress core software security.