The idea is that all security fixes would end up in cssu-devel, cssu-testing, cssu-thumb, AND cssu-stable/cssu-security/whatever.
Anyone running Thumb is going to be somewhat bleeding-edge anyway because you need a new kernel and some other "riskier" parts.