Just as Project Treble separated out the low level device drivers (CPU, modem, camera, etc.) provided by the hardware manufacturers from the OS itself and allowed for monthly Security Updates that didn't require an entire OS update, Project Mainline is separating out almost everything in user space from the lower level parts of the OS so that the former can be updated directly from Google Play rather than from that monthly Security Update.
If you go to Settings->Security, you'll see both "Security update" and "Google Play system update" as two separate entries and corresponding dates, reflecting that.
Edited to add: Project mainline was originally released in Android 10 and there were 8 modules that could be updated via Google Play, Android 11 expanded that by adding 12 more modules for a total of 20.
which was already the case since ... android 8?
so i'm very confused
I don't know if that means Samsung doesn't get to decide when you get updates or if it means "we're delaying security updates from being pushed to AOSP so you better have Google Services installed if you want your vulnerabilities patched in a timely fashion"