From being behind the scenes during the Jetpack issue, the WP security team is extremely conservative on what is in an auto security update.