Dude, that's not bad at ALL! Some people on some carriers, on some devices are months behind at times! If you want the most timely patches and updates, then get a Pixel! lol
Got the October security update last week for my Verizon S9 Plus. Three weeks behind Google for security patches is not bad at all. It's been this way for Verizon S-series phones since the S7. They have about a 3 month lag while things are sorted after release but then the updates come like clockwork.