Ask HN: T-Mobile just pushed a 300+MB update to Galaxy S7 but Security=August 1?

Is it typical for USA carriers to not bother with security updates for over two months?

Tuesday, a well-over-300MB software update was pushed to all of our Samsung Galaxy S7s (they do this even over mobile data without giving you a chance to shift to WiFi first, but that's a different rant).

Anyway, it installed smoothly, as Android updates go, but a subsequent Software Status check says "Security Patch Level: August 1 2018".

Is it normal to leave security updates at over two months old on the day you push it?