Yes, security-problems should not be made public, just to the developer himself to make sure he can provide a quick fix.
That's how it works well here on vb.org - I can a message telling the details, checked it and could fix it in time, and that's what the community needs. Otherwise there would fly around some usermade hotfixes, some ideas ect which do not help having a stable product with support and development, as modified trees could get out of this ect.
Everything is fine now, everybody just upgrade to v2.7.1+