Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
There is a plug-in that will send you an email whenever an update becomes available (security updates and otherwise). This will be one of the easiest ways to get notified via email:
Alternatively, there are usually emails on the WP-Testers email list immediately following an update. You can always subscribe to that to see both when updates are ready and when users find exotic bugs that might affect your system.
Finally, the core team is fairly consistent in blogging about security patches on the WordPress Development Updates site. And, conveniently, the site offers email updates :-)
So there are three different options ... hopefully one will work for you.