Paying top shelf price for a product you'd hope that you're not just paying for the latest in hardware and software at that time but that they have a commitment to making sure the product... hardware and software... is supported at highest level pushing updates and bug fixes to continually run at its best and show a level of commitment to it... at least for the year.
But unless you bought a Nexus or Pixel, you pretty much know you're not going to get the type of updates iOS does. You buy a product like an S8 that had the latest and greatest 7.0... you know you're not probably not going to get 7.1 in its lifetime and have to wait for 8.0 and buy that time new phones will probably have gone 8.1.
Where you buy a Pixel and people will still say it's the fastest smoothest running phone a year later and maybe beyond because it continues to get the latest updates the day it comes out, Samsung phones will be known to start getting 'the lag' after some time and you live with it. I really hope not the case since this is my first Samsung.
Security patches are from the manufacturer directly without having to wait for carriers to push. You'd think companies like Samsung would dedicate a little more into their Software side to Security updates regularly. The fact they don't shows how much they really put into a phone after it's been released... Heck they are even known to be worse updating their own unlocked phones.
I don't immediately install the latest updates on my million dollar servers at work.
Patches can and often do break applications and/or disrupt the proper operation of hardware.
Just recently I patched openssh for a security vulnerability, then couldn't login because the patch changed to encryption and the app used to login couldn't use it. The app which is 3rd party, also needed an update.
My WAS servers need to be parched, but I know the patches will break some of the apps on the server, so I can't just patch them without thorough testing of the apps using WAS.
My point is, just because a patch exist doesn't mean immediately roll it out. It needs thorough testing.