I don't see any security-related fixes. Is VBox that solid or am I missing something? I remember also looking at previous versions and not finding much...
"VMM: many more fixes", "GUI: various bugfixes and internal cleanup", "Audio: various bugfixes and infrastructure improvements" - who know what that means. If nobody disclosed it externally as a vulnerability, they could just call things "bugfixes".
But it's not like they don't get any security issues at all: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=virtualbox