because updating a single app via the app store is faster than updating the whole OS. Having a security vulnerability in a browser could be fixed immediately, but having to ship out a whole new OS leaves it open for a while. Especially with users generally being against/too lazy to do OS updates

Exactly this. We so often see people still using iOS versions from ~4 years ago despite having options to update. Apple holds the ecosystem back.

Except that they can and have pushed security updates that are not necessarily OS updates. Granted the process is still through the settings app, but the point still stands. They have a channel for pushing yellow and red alert updates. Anything else can easily wait a couple of months.