I have noticed that many companies are doing this but definitely not all.
Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or authenticated? Does an update on a company's website suffice?
EDIT to answer comment: I am asking about any app, such as one that can be found in the App Store or one that can be used through an internet browser, I understand that specific categories of apps might be governed by specific conditions, but at the broadest level of apps, are there any laws that require this notification? Since many of these apps/companies are global, it does not have to be restricted to U.S. law.