Some Windows Updates rely on registry key information to detemine if the update is applicable or not. If the registry information still exists from an older version that was not uninstalled properly, an update will keep trying to install itself, or at least, keep reoffering itself to the client computer, even after successfully installing. It’s a definite headscratcher.
If you have an update that performs like this, one of the first things to check is a leftover, or orphaned, registry key. If it exists, delete it, and then resinstall the security update once. This should keep the update from reoffering itself.