They usually do, whether they announce anything about it or not. Sometimes, if they think the vulnerability fix is already in the works, they will simply add it to the next Security update. I think they started taking security much more seriously a few years ago. "Security by Obscurity" didn't sell too well.
