While working on #642110: Add native support in project_release for a "Security update" term I noticed that project_release_db_save() is pretty dumb now that we have drupal_write_record().