Well there are currently 59 issues https://github.com/btcpayserver/btcpayserver/issues

Plus, a company's website is a much hotter target for hackers than the average users computer. Its a much much hotter target to go after a publicly facing system that has money in it. So I imagine they're being vigilant about any vulnerabilities that were secretly reported to them by white hats, or they're just fixing normal reported issues or both.

Either way, I think it should be normal to expect lots of update from a hot project that handles money and good on btcpay for being active about its development.