Update docs to reflect new health & info security

See gh-13722

spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc

@@ -3260,8 +3260,8 @@ default. The `management.endpoints.web.exposure.include` property can be used to
 the actuators.
 
 If Spring Security is on the classpath and no other WebSecurityConfigurerAdapter is
-present, the actuators are secured by Spring Boot auto-config. If you define a custom
-`WebSecurityConfigurerAdapter`, Spring Boot auto-config will back off and you will be in
+present, all actuators other than `/health` and `/info` are secured by Spring Boot auto-config.
+If you define a custom `WebSecurityConfigurerAdapter`, Spring Boot auto-config will back off and you will be in
 full control of actuator access rules.
 
 NOTE: Before setting the `management.endpoints.web.exposure.include`, ensure that the