Well, this is not "fixed" in the original context of this issue, however we now have a proper release update RSS feed https://lib.openmpt.org/libopenmpt/feed.xml as well as a security and release announcement mailing list https://lists.sourceforge.net/lists/listinfo/modplug-libopenmpt-announce .
Additionally, we have security backport branches in the subversion repository for the maintained versions at https://source.openmpt.org/browse/openmpt/branches/libopenmpt-0.2.7386-beta20.3-secfix/ and https://source.openmpt.org/browse/openmpt/branches/libopenmpt-0.2.7561-beta20.5-secfix/ which contain more to the point commit messages than the original commits.
Retro-actively adding [Sec] tags to the 0.2 changelog is very probably not required, thus closing this issue now.