Security Patch OTAs & "Bug Fixes" are two different things.
All OEMs running Android, have 90 days from Google's release of it's security bulletins, to release the Security Patch Updates, as per the agreement with Google.
Samsung's "Bug Fixes", are entirely Samsung's responsibility, and when there are some issues, it isn't always a simple task to correct them.
First issues have to be identified, be able to be reproduced & then the solution needs to be found & coded.
Rather than Samsung releasing multiple updates for the same device, it kind of makes sense for them to delay Security Patch Updates, so they can include any other fixes in the same update.
I get that when you spend, a "bucket load" of money on a new device, you would like to be able to expect, timely fixes & other updates on a regular basis. Unfortunately, this is not always possible, and I'm pretty sure that it's not for a lack of effort on Samsung's part.
It's "easier" to provide updates to older devices, as most issues have been resolved, and solutions for any new, or remaining issues can be often more predictably found, fixed & released.
On my S20 Ultra, I've been receiving the Monthly Security Patch OTAs quite regularly, but then as I mentioned,, my device does not have any issues that require correcting. So all Samsung needs to do is provide the Update which addresses Google's security bulletins.