I do agree that it is a good idea to have such a thing, however I'd vote for a real 'security only' list. Otherwise there is a risk of 'scope creep' with the traffic volume increasing, discouraging people from subscribing.
A good example is in this case the debian security archives - they are succesfull because they are kept strictly 'security only'.
To combat the 'fragmentation issue' - keep the security announcement list strictly to announcements. As soon as it turns into a discussion, redirect to the normal dev or q&a lists.
Maybe the 'news' package is a better fit in this case. With an extension so that 'post news item' results in 'create matching forum thread' and link to it in the news item.
This way you have best of both worlds
- an explicit trigger for important announcements
- no fragmentation of discussions
