I've watched a lot of Driesnotes. A lot. Goodness me, I don't even know how many.
Over the last few years, and I promise to find out exactly how many, Dries has had a lot of help with the design of them from an awesome designer at Acquia who I just have to shout about - ASH.
(yes, absolutely go give the shout outs!!)


Most Drupal site owners I talk to handle Drupal security updates the same way. These are the fixes the Drupal Security Team publishes for core and contributed modules. A developer sees the security advisory. A ticket goes into the next sprint. The patch goes live a few days later, sometimes two weeks later.