Why did Views just jump from 3.8 to 3.10 (what happened to 3.9)? There was a security advisory issued for Views yesterday, but the new version is two ahead of the last (3.10 to 3.8).  What happened to 3.9?

The Views release page doesn't list a 3.9, or a reason why there is no such version.

Is this some new security rule I don't know about?
I can't say exactly what's happened in this particular case, but:

It's fairly common practice to do a double release in the case of security updates. Core for example, does this every time, although I couldn't find a reference to the practice right now.

Let's say you've released version X.Y.

Working on X.Y + 1, you've made some number commits on top of X.Y. Now you find a security problem in X.Y, and need to address it. You can now quickly rush out X.Y + 1 along with your additional feature work, and the security fix.

However, your new feature work isn't as well tested as it should be, because you hadn't prepared for a security emergency release. So although it might function perfectly well, likely, your work is "more buggy than usual".

Also, big sites are likely to be careful in upgrading versions, they'll need to take their time testing the site, making sure everything keeps working.

Any delay in the security update process is bad however, so we'd really like to be able to help people upgrade as soon as possible.

So what can we do? We can take the security only fix, and make a separate release of only that.

In this particular case, it looks like the feature release was done first, and then the security release. If I wanted to security patch my 3.8, I would have to pull out the diff between 3.9 and 3.10 and apply it. I could then take my time upgrading to the real 3.10.

If you look to Core for a similar example, check git log 7.31..7.32, which will show you that "SA-CORE-2014-005" was fixed on October 15th, however, the later release, 7.33 (git log 7.32..7.33) will contain commits from both before October the 15th and after. Gits history was re-written, such that the security update alone ended up in the next release, and any additional work then went into a new release. This requires more git trickery, but further lowers the bar for upgrading. In the case of SA-CORE-2014-005, this was important. Not so  much in the case of the Views issue, which was minor.