I think everybody from first half of 2017 who hasn't received PPR is in that same status of the security hasn't started.
After reading about GCMS notes and security checks in the past few days, i only have two explanations for that:
1. they are preparing to send applications for the security check in a batch
or
2. they are doing the security check already but the status doesn't reflect that for some strange reason (could be for security purposes or smth). If they are doing the security check, there should be several activities pertaining to that in your GCMS notes. My April notes only show 2 activities in the Security check part, one of which is redacted (I suspect it's my spouse's details that's why they are redacted), so I think my security check truly hasn't started yet, but who knows what's happened in the past 2 months.