Sorry, but thats just a perfect example why 'security through obscurity' is wrong. I have zero idea about security risks, but if fix does not mentioned anywhere, then for people that use previous version there no rush to upgrade.
I suspect the overwhelming majority of Factorio players are using Steam, which auto updates.
I would say that servers only tend to update when large features are released. So announcing a security vulnerability would likely push some servers to update.
I know I've held back my copy of Factorio due to some concern over changes in newer versions, preferring to letting the dust settle before upgrading to the latest stable version.