> Java includes the JVM which is subject to way more security issues and needs much more frequent updating.

Then releasing more often is better, because the security fixes get out of the door faster?!

If previously a Java Update took 3 years, then the corresponding JVM version would be 3 years old as well.

If there were patch release in between, I see no difference to now.

Patches are released continuously. The upstream versions get them immediately and they are then backported to LTS versions. Whether the patches actually become available simultaneously I cannot say without.