How are security updates applied?

They seem too small and consistent in size to just be bundles of system apps that got security fixes the past month. Are they like differential patches or something? How are they applied? And what happens while the 'finishing system update' notification is shown? (as far as I can tell the phone remains unlocked while updating, so why do they need it to be booted to finish the update? Is it just to turn on the phone faster?)

Web search returns 'what is an update' articles so I'm asking here.