Right click - update security

https://planet.mcafee.com/thread/114523 --Bidgood, Joe

A right-click/update security will always try to update every product that it can: this means every product *in the repository that the client is using*.  The agent downloads the catalog.z from the repository, which lists all the packages that the repository contains. The agent sorts these into packages that are applicable to an update (as opposed to packages that can be used for deployment) and displays a list. Essentially the agent is saying "this repository contains the following updates: I will update anything on this list that I find on the machine."
That's why you're seeing products that may not be installed: at this point in the script the agent hasn't checked the client machine to see what is actually installed. This is also why you get different results when a client updates from an ePO-controlled repository and the McAfeeHTTP repository, for example: the two types of repository contain different packages.