Not everybody is going to install .NET 4.5 on Vista/Windows 7 or Windows Server 2008/2008 R2, so they'll need to continue issuing security fixes for .NET 4.0 at the very least.