maint-announce has been created as an administrative use project, it will only ever be used a private space for tracking vendor communications.

In T89781#1047165, @csteipp wrote:

Is John Lewis a volunteer member of the ops team like Jeremyb? If John has root, then it's ok to have security bugs like all of ops.

Otherwise, I'd rather keep access to mediawiki security bugs restricted to those community members who have reported and fixed multiple security bugs, or have demonstrated a need to have access.