Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
What if there's a bigger security fix you need to push to people asap?
We usually let between 24hours and a few days before doing an upgrade, seeing the possible regressions.
From tag to release to updates can take only 4hours, if we want enough mirrors.