My take on it is that until the flood of discoverable vulnerabilities slows down it doesnt make sense to release data that could make it easier for bad guys to find them.

Want the build the stats? Data mine the patches, and infer it yourself, publish it if you want to. That's how some people find bugs that aren't disclosed as explicit security fixes (and not every security issue needs a disclosure and fancy name, especially if it is introduced,found and fixed in a dev cycle before the code is part of a release)