iOS 13.1.2 update 113 MB on my iPhone, but 3.7 GB on iTunes? Why!?

You are downloading but you are not installing.

During installing the update will check with Apple server whether the iOS files are intact and genuine.

Each step of the startup process contains components that are cryptographically signed by Apple to ensure integrity and that proceed only after verifying the chain of trust. This includes the bootloaders, kernel, kernel extensions, and baseband firmware. This secure boot chain helps ensure that the lowest levels of software aren’t tampered with.

When an iOS device is turned on, its application processor immediately executes code from read-only memory known as Boot ROM. This immutable code, known as the hardware root of trust, is laid down during chip fabrication, and is implicitly trusted. The Boot ROM code contains the Apple Root CA public key, which is used to verify that the iBoot bootloader is signed by Apple before allowing it to load. This is the first step in the chain of trust where each step ensures that the next is signed by Apple. When the iBoot finishes its tasks,

it verifies and runs the iOS kernel. For devices with an A9 or earlier A-series processor, an additional Low-Level Bootloader (LLB) stage is loaded and verified by the Boot ROM and in turn loads and verifies iBoot.

iOS update needs Wi-Fi connection because every steps must be verified by Apple server.

Cellular connection is not so stable for secure back & fort communication.