I asked about this on IRC and was told that 3.2 is now a standalone branch
like 2.7. Security fixes will be applied by the release manager only,
and Georg doesn't see any point in null merging the commits.
Well, there is no harm in merging 3.2 to 3.3. I think, 3.1 remains merged to 3.2 even if 3.1 is under security only mode.
It will be our practice that we do not port bug fixes to 3.2. This can be mentioned in the Misc/README. But when it will be a security fix, it will go through 3.2->3.3->default and having them merged may be a good idea.