Because grsecurity make no effort to separate out their patches, it's really hard to upstream them. Sometimes the Arch team get the effort in time, sometimes its overly difficult so you don't get the kernel rolled out by the time an update is available for plain.