That's true, it should not take so much time to release a simple security update. The Android 8.1 base for these phones is also older now, there are many bugs and improvements that have occurred since the one used on the device.
With Android 9.0 they should have device specific stuff in the vendor, and if there is any other specific software that be done through an updatable module. This way they can keep the base OS updated, and every device receives the same update at the same time, since the OS is the same. Similar principle to the GSI available on XDA etc. The current system isn't sustainable and disadvantages the user with late updates and not having the latest revision of Android.