I applied the concept of Epoch SemVer https://antfu.me/posts/epoch-semver
Without actually using it, I can't have an informed opinion about it.
I disagree with SemVer that security fixes are just patch bumps. Some security updates require a breaking change, requiring the major version to bump. Epoch SemVer supports that.
Bumping the version 1000.2.3 → 1001.0.0 could signal a security fix with behavior changes in backwards-incompatible way.