You're right, but whenever I hear the words "Core Update" I usually think "Testing". For something this serious just getting that vulnerability patched asap seems like a good idea, especially if you look after a lot of drupal sites.