Well the changelog is also there to help the reader understand what's important. If you categorize everything as a bug it's difficult to understand. That specific PR you mentioned is resolving part of a CVE and it's definitely a security issue