The last discussion was in August 2020, when we discussed decommissioning the mailing list; in the following 12 months there have been a few cases of issues reported through the security email alias, and they were either handled directly, or redirected manually to security.gnome.org.
I'm okay with a complete decommission of security-list, and an autoresponder at security gnome org that redirects people to https://security.gnome.org.