I think it is OK since it gives predictability. For the problems found internally or reported discreetly to Microsoft - there is very little chance that exactly the same problem will be rediscovered in 2 weeks (average of month).
Of course, for the problems which were discolsed publicly, or when the exploits were spotted - the critical patch will be issued immediatelly.