The lack of security advisories for even the major open-source Android distributions scares me: can anyone imagine if major Linux distributions provided no security advisories?

I run CyanogenMod Stable on my phone, the kernel build date is given as Sep 23 2013. Are they really meaning to imply that no security advisory published for Linux after that effects CyanogenMod? Most are purely local attacks, but still therefore malware vectors, and then there's things like CVE-2013-7027, which on the face of it should effect Android.

At the moment, I'm running CyanogenMod purely under the assumption it'll be more secure than the default Samsung installation (no updates in about two years), as at least it gets updates! Yet, at the end of the day, I see little to convince myself they are actually keeping up with upstream security fixes. No Android distribution seems to have a coherent story when it comes to security advisories, sadly. :( (I have a Galaxy S2, if anyone wants to convince me to try another distribution/OS!)