Maybe they are kept back because not security updates?
>From $ apt show unattended-upgrades Package: unattended-upgrades <snip> Description: automatic installation of security upgrades This package can download and install security upgrades automatically and unattended, taking care to only install packages from the configured APT source, and checking for dpkg prompts about configuration file changes.
