Part of it will be because an uodate needs a restart of an app, a service or reboot(kernel) to actually update. People think the update finishing means everything is now running new code in memory, but it will hold old code till it is allowed to use the new stuff. Not sure on a deb system but with zypper ps -s it tells you exactly which packages are not running latest updated packages and need to be “released” before it can