smooth criminal

Try full-upgrade and see if it shows any?

The only difference between upgrade and full-upgrade is that full-upgrade will remove packages if necessary (like if an installed package conflicts with an update), whereas upgrade won't.

Possible that you were pending a kernel update before the reboot, and the system was ineligible to those security updates at that moment.

Sounds like your install is old enough where it doesn't qualify for the updates. You get like 5 or 6 ESM keys for free i think.