I agree that it would be helpful if update related emails went to a developer email rather than contact_email.
(context)
The main reason being that the contact_email is listed publicly as the support email for anyone to contact for general inquiries or support.
I believe it would make more sense to link an email like that to a support ticketing system operated by non technical staff. While the critical notifications regarding the security of the Discourse instance (like security updates available) should go directly to a server admin email (ideally without needing a user account created for that email).
A webhook would be super nice also, which would make it possible to send these critical alerts to Slack, Discord etc.