Yup. This is exactly what it says in the letter I received:
"This is in reference to your application for a permanent resident visa, which has been found eligible in the class for which it was submitted. Admissibility review (security, criminality and medical) is still on going; you will be contacted if additional
information is required for that purpose.
At this time our records indicate that you have not paid the required Right of Permanent Residence Fee (RPRF). You must pay this fee before a permanent resident visa can be issued....."
You see, according to it, only my eligibility is passed. However, I passed my Medicals back in August, as well as other stages, as I was told by the agent yesterday, a day after the RPRF payment.
I am quite positive that there is no a certain timeline of Processing Stages in terms of what they check first and last.
If you look through the timelines of those who received PPRs, you will see that some people got their Medical under review until 2-3 days before the PPR email. So for them starting all 3 other stages (Background, Security and Criminality) and completing them in 2 days is quite unrealistic.
From what I saw in peoples' GCMS notes that they posted (you can also google them), Security and Criminality were passed one after another within a few days, so I assume they make requests to check those at the same time, because both of those stages require quite a decent amount of time.
Security check is done by Canadian intelligence and security agencies, with or without cooperation of proper authorities in countries you lived/stayed in, and it is done completely independently from CIC - CIC only gets result, which will be positive or negative, without any explanation (as it is classified). At this stage they "dig deeper" into your life, activities and associations to find out if you are/were involved or are/were associated in any way with anyone who is/was involved in espionage, terrorism, organized crime, radical movements, crimes against humanity, war crimes, etc.
Criminal check looks into your police certificates and verifies with relevant countries to see if you have a criminal record that may make you inadmissible to Canada. Therefore it would make sense if the two stages were done together.
But either way I am not an expert, and I guess no one knows what exactly CIC has in their mind