I guess many webhosters run a WAF that blocks known WordPress exploits, protecting sites that don't update wordpress (quickly). And presumably wordpress.org somehow helps with configuring WAF rules for this.