i DHershberger2,
I received confirmation overnight that VVD customers should apply the security patches without waiting for updated BOMs and that they will be considered still aligned to the VVDs
This corresponds to the security patching notice on all VVD release notes.
For example https://docs.vmware.com/en/VMware-Validated-Design/5.1.2/rn/vmware-validated-design-512-release-notes.html
VMware makes available patches and releases to address critical security and functional issues for several products. Verify that you are using the latest security and express patches or hotfixes for a given component after deploying VMware Validated Design. Scalability and functionally tests for individual patches, express patches, or hotfixes are not typically performed against VMware Validated Design. If a patch must be applied to your environment, follow the VMware published practices and VMware Knowledge Base articles for the specific patch. If an issue occurs during or after the process of applying a patch, contact VMware Technical Support.