The only answer is: It Depends(TM).
It depends on several factors, including:
- Whether the version of Ubuntu you are using is End of Life (in which case, never is the answer) or End of Standard Support and under ESM maintenance (which means that that schedule is not known to the public if there even is one)
- Whether the package is in Universe (see point #2) or Main (points 3 and onwards),
- Whether someone is sponsoring the security patch and driving to completion with the assistance of the Security Team (Universe packages only)
- Whether the security update in question is embargoed (in which case the answer is "Wait and see")
- Whether a security update is affecting all Linux releases and the major distros are coordinating on a coordinated release date (in which case "wait and see, because everyone'll get the fix at the same time")
- Severity of a security fix's requirement according to the Security Team,
- how much other stuff is on the SEcurity Team's plate at the time.
Essentially, there is no "Patch Thursday", and as security updates are released and USNs are published is when the security updates come. However, there is no fixed schedule for security patches from the Security team.
(This answer is a statement based on my being a member of the Ubuntu Core Dev team and having a lot of coordination on things with the Security team on things)
