Hey,
this has a number of reasons.
The main one is that we are very constrained in engineering resources and cutting a new release is not a fully automated process.
There is a lot of automation in place (otherwise it would be much harder/impossible to manage given the size of Ory ecosystem),
but there is still work involved regarding the SDK generation and breaking changes, as well as documentation.
Plus new features can be tested on Ory Network much easier, and they are usually included.
If there is a critical bug or vulnerability, there will be a release as soon as the fix is in master.