QPR and security updates are different things.

My understanding is as follows: They're delaying source code releases for security updates, but they're privately sharing source and binary security updates with partners. Source releases are embargoed, binary releases aren't (I assume it's to avoid triggering the ecodesign clock)

When patches go out to partners in October, they are immediately released by GrapheneOS for users who opt-in for "security preview" releases. Stock Pixel users might get them in December (triggering the ecodesign clock), and other brands could get them as late as April (per ecodesign requirements).

So the timeline could look like:

June: Vulnerability discovered

September: Vulnerability patched

October: Source and binary patch sent to partners. Patch can now be reverse engineered and actively exploited.

October, shortly after: GrapheneOS releases an update with the binary patch

December: Vulnerability is officially part of the December bulletin, Pixel officially gets the update

January: Samsung releases the update

April: Everyone else (legal worst case)