But they're not really behind. I already got the 1 January Android security update a few days ago on my S23.
Considering they need to do testing and possible modifications I don't think this is very slow.
Seems like anywhere between one to three weeks. I think the auto update is a bit lazy. Had to force update on mine just now to make it get January update.
It's not perfect but I like it now (In the TouchWiz days Samsung was really bad at updates, they've improved a lot)
I wonder if it's your provider being difficult here. The problem with branded (or sometimes even sold with contract) phones is that the carrier wants to meddle in the updates because they're afraid of issues on their network or something. And this can cause huge delays.
I always buy my phones separately, mainly because I hate contracts so I'm on prepay always but having unrestricted updates is another big benefit.