Not my dept but I'll wager timing depends on:
A) If we want to wait and see if there's any security flaws that crop up before including.
B) Other times we can't wait to get the next version in for improvements to protection ie: "to keep on top of new spam techniques being used by spammers".
C) How many other things we're packing into a maintenance release (btw 5.0.3 has tons of new stuff) sometimes it's a straightforward process & other times we'll want to configure certain things.
3.2.4 has been out since January with no huge issues last I checked issues.apache.org, where as 3.2.3 came out in August of last year. You'll occasionally see things like
Bug 18145 - SpamAssassin 3.2.1 or
Bug 14677 - Update ClamAV to 0.90 and SpamAssassin to 3.1.8 in bugzilla but some things have gotten kinda automatic to the point where we don't always file for that.
2008-01-05: SpamAssassin 3.2.4 released
2007-08-09: SpamAssassin 3.2.3 released
2007-07-25: SpamAssassin 3.2.2 released
2007-06-11: SpamAssassin 3.2.1 & 3.1.9 released
2007-05-02: SpamAssassin 3.2.0 released
2007-02-14: SpamAssassin 3.1.8 released