Apple has done silent updates for Gatekeeper, the macOS code signing/file quarantine/light anti-malware framework ever since Yosemite. These are done silently unless you explicitly disable all updates and only show up as a visible item when you manually list updates using the softwareupdate command line tool, I think. AFAIK these are just config files and hash databases or similar.

You can view the history of these installs by running softwareupdate --history | grep -E "^MRT|^Gatekeeper"

I see an average of 2 updates per month.

FWIW Apple can also mark something as visible (but install automatically) with a certain config file key. A blog mentions this as being done for patching the NTP bug from a while back:

> Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible.

> Meanwhile, an automatically installed software update like OS X NTP Security Update 1.0 shows up as a normal software update, but has extra keys in its catalog listing to mark it as a critical update whose automatic installation is set to occur as soon as possible.

https://derflounder.wordpress.com/2014/12/27/managing-automa...