And your internal releng process should be handling security issues as they come up?

That may start to get rough with MFCs as the branch petrifies, but yes it should fall within the same crosschecked two engineer budget for a reasonable time span. You should seek commit bits to maintain said branches if you rely on them, because you're probably not alone.