Is there a way to send an email about security updates?
There is a security notification civicrm group that you can subscribe to on civicrm.org


https://civicrm.org/advisory/subscribe


Security updates and notifications have not been tied as yet. Definitely this would be a good addition to the project