Following up on this question I checked and confirm that the joomla demo site shows it is on 4.6.0 and has 'security releases' available
For background: The demo, training, test, and many local-dev systems for Drupal+CiviCRM and WordPress+CiviCRM are based on a common set of scripts, and they all install clean copies of Civi from git (using branches or version-tags). The demo sites are automatically rebuilt every night using the scripts. This keeps the sites up-to-date.
For Joomla: Installing a good, clean system for Joomla+CiviCRM from git is very difficult -- I and others have tried to automate it a few times and always given up. (Somewhere in my email history, there's a note-to-self about how hard this is. Alas, the language is too strong for publication.)
IMHO, there are two ways one can proceed with automating Joomla installation:
- Don't use git. Develop a different set of scripts based on zip files. (The nightlies might be good for this.)
- Rewrite the installer
At any rate... Without an automated installer, the Joomla demo site grows out-of-date periodically.