The mailing list for security vulnerabilities is private, in order to keep zero days a secret before they are patched. This is the issue, not the mailing list. Moving away from mailing lists wouldn’t solve this because the vulnerabilities would still have to be private.