This question is often asked, and the NRMP has been very open about it. It's all about error reduction.
It's not the algorithm. That takes less than 2 seconds on a standard computer. There are entire threads where I go full-math-nerd on this topic. Let's not rehash that here.
What takes "so long" is making sure they get it right. That includes:
1. They check the uncertified lists. Invariably a bunch of people end up with uncertified lists. The NRMP reaches out to them to let them revert back to their last certified list. The NRMP wants the match to work, not to punish people who screw up and try to change their list at the last moment (although that's dumb and don't do that). This takes a few days.
2. They ensure that all applicants are certified by their medical schools. I expect there are a few outliers they have to chase down.
3. They need to deal with the other matches. Usually, CaRMS results after lists are certified and before the match -- and all whom match in CaRMS need to be removed from NRMP. This year CaRMS seems to happen after NRMP, so that's not an issue. Same with the mil match but that's very early.
4. They have to copy the data from their web based ranking system to where they do the match. This shouldn't take long tho.
5. They run the match. 2 seconds max.
6. They error check. Over and over. They probably go through every single person and make sure that they couldn't be any higher on their rank list. If so, they move them and then that cascades to a bunch of changes. Then they start all over again checking. Errors like this can creep in due to the couple's match.
7. Once that's done, then they start all over again. Probably 10K times. Each time they get to a final result, and compare to the last result, looking for the "best" solution.
The delay is all about error checking. They want it to be 1000% correct. The Urology match once released results that were all wrong. It was an absolute disaster, and almost led to the collapse of the separate Uro match.