Not sure if I'll define it that way, but why not? If my mobile device is capable of showing inane ads as push notifications, why can't I expect security advisories to be delivered that way?