We don't disclose which mirrors are members of the security.debian.org
pool anywhere (that I could find), so we are currently hiding everything
behind security.debian.org. This wasn't a problem when a DNS lookup for
security.debian.org would return a RR-SET with several A and AAAA
records, but geo-ip changed that to return a single A record. When
geo-ip points security.debian.org to a broken or stale mirror for
someone, it is a pain to work around it for the duration.
And if you need to access security.debian.org over IPv6, "too bad".