As of March 5 2013, Ubuntu was still sending out security notifications, along with providing the necessary patches for vulnerabilities found in Open JDK6.

While Oracle has ended support for public updates, the Open JDK6-dev team has stated:

"Oracle ended public updates of JDK6 at the end of last month. Many
people seem to have concluded that the OpenJDK6 project will therefore
end at the same time. This is incorrect: OpenJDK6 will continue, but
will be maintained by the community outside Oracle."

What about security updates?

"We'll back-port them as they arrive and commit them to OpenJDK 6.
However, there may be some delay because of the effort and testing
that back-porting requires. Therefore, if you want the most secure
and up-to-date version of OpenJDK, you should update to OpenJDK 7.
We'll also fix any security bugs that are found in OpenJDK 6 alone,
but again there may be some delay."

At this time, security updates will be backported to JDK6 as long as there is a community to support it. Presumably, these will be rolled into Debian, and down to Ubuntu.

You can read the entire thread in the March 2013 jdk6-dev mail archives under the title: The future of OpenJDK6.