Because this isn't "a single Safari bug." It's a bug in JavaScriptCore, which is a public system framework. Safari uses it, but so does any other app which links against it.
Fixing this bug requires shipping new versions of system frameworks, which is pretty much the definition of an OS update.
Or, they could bundle a separate version of the WebKit frameworks just for Safari (like the Safari Technical Preview does) – but then loading a website in your app would use a different stack of frameworks than loading that site in Safari, and no one wants that either.
Fixing this bug requires shipping new versions of system frameworks, which is pretty much the definition of an OS update.
Or, they could bundle a separate version of the WebKit frameworks just for Safari (like the Safari Technical Preview does) – but then loading a website in your app would use a different stack of frameworks than loading that site in Safari, and no one wants that either.