Security bugs have nothing to do with the Drupal Association (DA), there is an specialized team on charge of security AND the head of all Drupal development is Dries, he has a long and very well structured list of core committers, with clear duties, reporting straight to him, although everyone belongs to different companies or are self-employed. That is normal practice in community backed Open Source projects btw. Contrary to that, in STEEM we have a team of guys from the company, on charge of releasing the code, along a band of 20 guys with no clear structure and duties. What do one is supposed to expect from that? Or better said: