https://www.bleepingcomputer.com/news/microsoft/microsoft-explains-whether-a-vulnerability-turns-into-a-windows-security-update/

Microsoft has released the criteria used to determine whether a reported and confirmed vulnerability is resolved through a security update or in the next version of Windows. These criteria were released in order to provide insight into the decision making progress and to receive feed back from security researchers.

According to Microsoft, when a vulnerability is reported they evaluate how it should be handled by asking two questions.