Why wasn't the 25.3 release based on the then-head of the emacs-25 branch?

[Glenn Morris]

Hi,

I've just noticed that the Emacs 25.3 release seems to be literally just
the 25.2 release plus the enriched changes. Specifically, it seems to be
based on 784602b. Why wasn't it based on b638993? There were very few
changes in the emacs-25 branch post 25.2, and I don't see why they were
omitted.

In particular, it's disappointing that 94a6c96 isn't included. This
(security) issue was reported to emacs-devel three years ago.