Given the unprecedented amount of Tor security issues in the recent weeks, I think it would be a prudent idea to publish a Whonix point release for every Tor security release, as soon as possible, for the time being.
Tor is the crucial attack surface in Gateway, and the latest Whonix point release ships with obsolete version 0.4.9.11, which has a series of high-severity security issues.
Personally (and I’m sure that a lot of people are also “guilty” of this), I never touch Whonix once it’s set up - I keep the disks in VirtualBox immutable mode instead. I’ve always considered updating Whonix a messy process, and sure, today I tried it for the first time ever, just to get Tor 0.4.9.12, and it didn’t go too well - errors with guest additions and some other minor packages. But I digress.
Either way, even if you do keep your system up-to-date properly, you still need to bootstrap Tor and Whonix somehow, and it’s not great when it’s done from a potentially vulnerable version that the latest point release ships with.