Apparently it knows from Github Advisory Database which would "tag" the release as "security"

yeah I saw that as well. My question is still valid. How does it differentiate a version update from a security update?

how does it distinguish version updates from security updates?