Comment by janfoeh

He had enabled a setting that says "Install [...] security updates". If enabling that setting does not lead to the system installing security updates, that's on Apple.