That's how everyone does it today, but given that GitHub has an issues product, it really should be better integrated.

The main issue is that issues are publicly viewable, while security alerts are only available to certain users (e.g. repo admins). Since repo owners of e.g. popular OSS repos might not want public issues around their security vulnerabilities, this isn't something that's been actioned.

Should GitHub offer more granular permissions on issues to resolve this? Probably, but unfortunately that's reaching fairly deep into how GitHub works today.

(Disclosure: former Dependabot PM, no longer at GitHub)