They actually do include non-security "GDR fixes" in cumulative security updates. See the KB article associated with them. For example a MS10-xxx security update fixed the "operation aborted" appendChild problem and made it actually work.