Yes. The problem with openly releasing a fix for a security bug is that people are not always quick to update their instances. It only takes one black-hat monitoring your releases by some means to dissect the changes, find the hole, and make an exploit that can be immediately used against unpatched systems, and the sudden availability of better automated tools for that makes it a much bigger problem than it was a year or more ago.

Information about the problem then gets released later, once everyone has had appropriate time to get up-to-date. Or not, and we are non the wiser.

Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.