Critical Patches
Security patches released outside the scheduled update cycle, are applied as a priority.
Most updates can wait for the scheduled monthly run. Security fixes are different. When a flaw is found in the software your site runs on, it's made public.
That's how security works. The flaw and the fix are published together, out in the open.
From that moment, automated bots start scanning the web for sites that haven't applied the fix yet. They don't single anyone out, they check every site they can reach, small ones included.
When a fix can't wait for the monthly cycle, I apply it as a priority, keeping the gap between a flaw going public and your site being protected as small as it can be.