This came up during the RKE2 session at the hackathon. SCS 0210 states:
The latest patch version MUST be provided no later than 2 weeks after release.
janeczku raised that there is no apparent reason for this to be a MUST, since CVEs are handled in a separate clause and for minor versions we allow four months.
Instead of choosing another (random) time frame, we discussed it might make sense to switch MUST for a SHOULD.