Because Samsung's track record as far as security updates has been rather shaky. They seem to get distracted easily. During the Oreo rollout they stopped updating the S8s for three months or so. My Motorola G5 Plus was actually on a more current patch than my S8+! When Motorola is doing better with patches than you are, you have a real problem!
Like most Android OEMs, security updates are not a priority. A sad but true fact.