Yeah, it's probably just some user experience thing, like the keyring is unlocked because you're logged in so it's trying to be helpful by not making you enter a password again, but it's a little sketchy when the user has clearly toggled all of the update switches off.