If they never publish any details of security issues (and certainly no CVE score), can you safely assume that you would never receive a genuinely important security fix? How would it feel later on, when your system was compromised and support is pointing to the update with the security fixes?

Yes, maybe that is some weird kind of fear of missing out (on security), but I have a hard time ignoring security fixes, even without details.