But everyone does that.
To be specific: everyone quietly fixes bugs which *might potentially* be considered security vulnerabilities, if just because they don't realise that they're vulnerabilities at the time they fix them.
You don't need to be nefarious to do that.
(Equally, known vulnerabilities in unreleased or released-as-development versions of free software are often fixed without formal vulnerability announcements, on the basis that anyone who was bitable by this bug is going to be upgrading often anyway, or why else would they be running a development release?)
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds