Most Drupal site owners I talk to handle Drupal security updates the same way. These are the fixes the Drupal Security Team publishes for core and contributed modules. A developer sees the security advisory. A ticket goes into the next sprint. The patch goes live a few days later, sometimes two weeks later.