The QPRs are in the same repo they're getting their security patches from.

That doesn't mean that they are actually allowed to release them. Big difference.