Given the large move of release dates for 4.0 (and 4.1), the security.txt expiry date as added in MDL-71270 no longer seems sufficient, since it would only be approximately 2 months. The minors on earlier versions can be updated in May minors, but ideally 4.0 will be released with a security.txt that is valid until around the the expected release date of 4.1 (+3 weeks as standard).