In reply to Alec.

It's unfortunate that there's no mechanism available for plugin/theme authors to mark an update as a security update, or to mark certain versions as insecure. WordPress core, as you point out, had security updates, pushed automatically, for years. But with plugins and themes, it's not possible to indicate that an update is a security update in any way that core will recognise.