They don't say that and they do reply by email before 150 days. Their reply will say something like "pending further security checks". It is safe though to wait for the 150-day mark before even giving them the initial email asking for an update.
I know because we had a few people recently email them 90 days in and the email reply said pending further security checks and the clients asked me what did that mean.
So they will indeed respond at 90 days but it likely won't be a response that the person will like. ALso, there are indeed many factors on why it can take some time...Especially if you have a PPT or sex crime.
:: @K SCOTT added on 11 Sep ’18 · 17:28
Sorry, let me correct myself. I meant to say that not in every single case will they reply with the message stating that no action will be taken before 150 days if you email them before 150 days. I have seen them reply with something like "pending further security checks. I have also seen them reply with the 150-day message. Some of my people check after 90 days even though I suggest that they wait at least 150 days.
I have also seen them reply that there is no timeframe as to when they will complete security checks. It is definitely more than 1 message reply that they may send.
So yes I do agree that 150 days is a good timeframe to check. I may have been mistaken when I thought you meant that the person would get absolutely no reply if they emailed before 150 days....which again is a bad idea. I still say that they will respond if you email them before the 150-day window but it will again likely not be a message that you will like.