Then why not provide just the security update as a free stand alone patch?
You'd have to ask the powers that be (the owner); speaking from experience with past releases (even through old companies) all releases are always done through the member area.
If a security patch is released and it is JUST that patch then I believe under Groupee they'd supply it via the support system; however that's IF a patch was made JUST to a specific version (such as the previous full release); if one was not created just for that then it'd be packaged with a minor release (such as what we just had) and be kept to the member area.