In fact, this is so. In most cases, to prevent vulnerabilities, it's enough to just install the update. But sometimes unexpectedly found vulnerabilities happen, for the elimination of which you must perform some actions on the command line before the update of the vulnerable component will be released.