because updating a single app via the app store is faster than updating the whole OS. Having a security vulnerability in a browser could be fixed immediately, but having to ship out a whole new OS leaves it open for a while.
Especially with users generally being against/too lazy to do OS updates