I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all the changes.
Are there any examples of some security fixes created for one framework and not another?
This information would be used to access risk of legacy .NET applications that have not been migrated to the latest and most supported version of the .NET framework.