As the Bugzilla user base expands, however, these thresholds must be re-evaluated. You should gauge whether this feature is worth the time and close monitoring involved, and perhaps forego implementation until you have a critical mass of users who demand it. This is confusing. You should probably set this number to higher than a small coalition of Bugzilla users can influence it. Groups and Group Security Groups can be very useful in bugzilla, because they allow users to isolate bugs or products that should only be seen by certain people.
Groups can also be a complicated minefield of interdependencies and weirdness if mismanaged.
This way, they can have a fix ready before the security vulnerability is announced to the world. Alternately, you may create a Group independently of any Product, and change the Group mask on individual bugs to restrict access to members only of certain Groups. Groups in Bugzilla are a complicated beast that evolved out of very simple user permission bitmasks, apparently itself derived from common concepts in UNIX access controls. The only way a bitmask scheme can work is by doubling the bit count for each value. Thus if UNIX wanted to offer another file permission, the next would have to be a value of 8, then the next 16, the next 32, etc.