.security index migrations (of which there's currently a single instance, but there are plans for more) should ideally be preceded and/or succeeded by a refresh operation.
Without a preceding refresh, docs that should've been migrated might be missed.
Similarly, without following a given migration by a refresh, any subsequent migration might experience docs version conflicts, or APIs relying on migrated docs might temporarily (until the next automatic refresh) return wrong results (e.g. the query roles API querying roles on metadata after a migration without a refresh will erroneously return empty results).