Interesting - they were added to WMF-NDA, but none of the acl*security groups. I've gone ahead and added them to acl*security_management, so they should be able to see all current security issues tracked in Phab (some of these are public if they're low-risk, etc.)