I reckon it's more likely that Safari as a browser represents a more important set of security holes and therefore Apple feels greater obligation to patch patch problems (and that's easier to do by simply shipping the whole app rather than patches for old versions).

This is exactly it - as long as they support macOS for X years they need to release safari updates for that long, so they might as well decouple that one.