The reboot is required because Safari is managed through a signed security volume (SSV). Unfortunately the inconvenience of that security feature means that most users will avoid patching, which defeats the purpose.

The requirement to reboot is supposedly fixed in Sonoma, with discrete ‘cryptexes’.

https://developer.apple.com/news/?id=3xpv8r2m

Sometimes you need a reboot for updating Safari, sometimes not. It depends on what components of it that are updated. Some of the stuff Safari uses are protected system resources that lie outside the application bundle itself, and I personally think the security scheme behind this is great.