I suppose that depends on the application of the transitive property of English grammar: "Install (system) (data files and security updates)" or "Install (system data files) and (security updates)"

Removing a malware app is installing a system security update.

Would you happen to have any examples outside of this particular update where an OS security update goes and changes something that the OS didn't itself create? Genuinely curious if this is a thing. The word "system" can be scoped any which way (see system of systems) but typically means "part of the OS" in this context.

Microsoft does this monthly with the Malicious Software Removal Tool which comes down as part of Windows Update.

Isn't it a security update of a system data file (the malware removal tool configuration)?

And it is a security update meant to annihilate a serious malware threat, not to mess with legitimate third party software.