I've seen a combination of approaches from the VOs in sending MRs and RPRFs. Sometimes the VO will "pass" the eligibility of an applicant and send the MR and RPRF. Other times, the applicant could be "recommended passed", and the VO may send the MR, RPRF, both, or neither. In case the RPRF is not received at this stage, it will be sent when the file is reviewed and passed by another VO. The application status typically changes to In Process after the eligibility is set to passed.
This has nothing to do with security, which only starts after you have been found eligible. In my case, I received the MR in December, but my ECAS status remained App Received until February, when it changed to In Process and I received a request for RPRF. My GCMS notes indicated I was recommended passed in December, and then the RPRF email in Feb said I was found eligible. So it took 2 months from the MR to the RPRF, which may not be typical.