Why after almost 3 weeks has VirtualBox 7.0.20 that has some CVE fixes not made it to Tumbleweed and Leap?

Because your https://build.opensuse.org/request/show/1189813 was rejected by the factory but with the messages below. Adding them to the changelog resolves that. 

A patch (fixes_for_vboxconfig.patch) is being deleted without this removal being mentioned in the changelog.
A patch (fixes_for_sle12.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-deprec-gsoap-service-proxies.diff) is being deleted without this removal being mentioned in the changelog.
A patch (fixes_for_leap.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-smc-napa.diff) is being deleted without this removal being mentioned in the changelog.
A patch (virtualbox-sed-params.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-fpie.diff) is being deleted without this removal being mentioned in the changelog.
A patch (security_fixes.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-default-os-type.diff) is being deleted without this removal being mentioned in the changelog.
A patch (fixes_for_qt5.13.patch) is being deleted without this removal being mentioned in the changelog.
A patch (smap.diff) is being deleted without this removal being mentioned in the changelog.
A patch (fix_7.0.6_locking_problems.patch) is being deleted without this removal being mentioned in the changelog.
A patch (fix_conflict_between_host_and_guest.patch) is being deleted without this removal being mentioned in the changelog.
A patch (fix-missing-includes-with-qt-5.15.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-python-selection.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-no-build-dates.diff) is being deleted without this removal being mentioned in the changelog.
A patch (modify_for_4_8_bo_move.patch) is being deleted without this removal being mentioned in the changelog.
A patch (fixes_for_makefile.patch) is being deleted without this removal being mentioned in the changelog.
A patch (VirtualBox-5.2.10-xclient.patch) is being deleted without this removal being mentioned in the changelog.
A patch (fixes_for_leap15.6.patch) is being deleted without this removal being mentioned in the changelog.
A patch (gcc5-real-support.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-python-py310.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-gsoapssl-deps.diff) is being deleted without this removal being mentioned in the changelog.
A patch (python311.patch) is being deleted without this removal being mentioned in the changelog.
A patch (vbox-disable-updates.diff) is being deleted without this removal being mentioned in the changelog.
A patch (libxml21206.patch) is being deleted without this removal being mentioned in the changelog.
A patch (fix_for_leap15.5.patch) is being added without this addition being mentioned in the changelog.

Where did these patches go, are you saying you included them in -patched.tar.bz? If do you'll want to document that.

For Leap you will need to make a maintenance submission.

Andreas