See e.g., T385792#10732958
As far as I can see, this could cause a problem for the use-case of using
@Maintenance_bot to automatically add team-projects in response to certain codebase tags; as a team might then not be notified of a security task in a component it stewards.