Comment by benjarrell

In a cluster, all hosts must be updated for the flags to be exposed to the guests. That is why you must update vCenter first, which prevents the patched hosts from being rejected.