AT&T hasn't yet released any security patches for the S9/S9+ phones beyond the Nov 1 patch.
And, no one, not even CS reps from AT&T, knows when an update will come.
They just suddenly appear without warning. Then it takes a few days to a few weeks for the support site to show the currently available update. That's how AT&T has rolled for years now.
Maybe... just maybe, they are preparing One UI 2 (Android 10) for release. AT&T has usually been more on the ball for patch updates the last few years, so, going this long is a bit unusual. But being late has happened on occasion, and getting Android 10 now is a real long shot.