This was already required in this case, you can see in the comments that an additional AppSec review was done and the appsec team signed off on the MR above and beyond the normal code review process.
Additionally, I see that the Senior Director of Engineering, Tim Zallmann, has left a bunch of GitLab project repos about 14 hours ago as of this writing. He was one of the folks who tried pinging [3] Mr. Coutable (he's one of the reviewers that's currently OOO). The ping is likely regarding the discovery of the security vulnerability.
[1] https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...
[2] https://gitlab.com/users/timzallmann/activity
[3] https://gitlab.com/gitlab-org/gitlab/-/merge_requests/76318#...