Do you think Apple is purposefully holding back critical security fixes?
Nope, but Apple often tries to bundle security fixes with other (sometimes planned) changes in iOS. I understand when feauture updates are not done yet, but why not patch the security issues in a dedicated iOS update? I would have understood holding back the update when they were expecting to ship 13.4.5 the week after this publication came out, but now it's three weeks and we have not seen 13.4.5 or a security patch for the known vulns.