Packages can still be updated, even if pinned. If a dependency of a dependency is not pinned - it can still be updated.