Followed the advice of vansmack and unenrolled
from the beta. Had the security update within a minute.
It would help if the people that got the security patch could also identify whether they are on Nougat or Oreo. I have yet to get it, and I'm on Oreo, which make me wonder whether the September patch was bundled with the Oreo version.
I had Oreo and was on the beta program. No September update. I unenrolled from the beta program and immediately got the September update. Like you, I wondered if it was bundled with my Android 8.0 and the answer is, no.