oss-security gets relatively little use?
You must know another oss-security. The one I'm subscribed to is very much alive and an important source of information for me.
Mailing lists are a lot like democracy. Imperfect, but nothing else is less-Imperfect.
It does get use in the sense that every now and then, some vendor sends 50 emails that could've been one (most recently, some Apache Qpid thing). But I wouldn't call that part valuable.