Patch bundles may contain multiple bulletins (Bug fixes as well as Security fixes). Depending on whether only one or both bulletins are included in a patch the size differs. See e.g. Understanding ESXi Patches - Size & Patch Bundles. If you are interested in what's included in the different patch packages, take a look at ESXi 5.x Patch Matrix.
André