In short: The September 2018 security patch began rolling out earlier this week, as it does every month for Google Pixel and Nexus smartphones. However, according to a number of people on Google's Product Forums, they have not yet received the September security patch. Typically, Google starts rolling out the update to everything within a week of announcing it (which is always the first Monday of the month), but for some reason, this month things changed. Now we have received the September security patch on our Pixel 2 XL here, so it's not that no Pixel 2 owners have gotten the update, but there is still a large group that hasn't.
Background: These monthly security patches were started over three years ago by Google, as a way to keep Android smartphones up-to-date, in terms of patching exploits that could make these smartphones vulnerable. Google releases a security patch each month, with a ton of exploits being patched. These updates then start to roll out for those on other devices, once the manufacturers get the code from Google – which is typically a month before Google rolls it out. Google itself has said that they are looking to get rid of monthly security patches, as it not that helpful and takes up a lot of time and resources. Instead, Google wants to move towards quarterly security updates, which is something that Motorola is already doing.
Impact: The fact that many Pixel 2 owners have not received the September security patch yet is really not that big of a deal. There aren't many exploits that were patched this month, that weren't patched in the August build. But those that buy the Pixel 2 want updates and want them fast, so it's understandable that they are upset. This is likely just an issue that Google is running into with some carrier builds, as it appears that all those running on Project Fi got the update quite a few months ago.