Yes, it’s been like this since the 10.0/public beta days at least. I remember wondering about it back then. I believe the command the system updater always runs is something like update_prebinding -root /