It's part of the new protections implemented in BS.
Basically, it uses a snapshot as a boot volume and then seals that, so malware can't modify the boot volume. When updating, it makes a new snapshot and seals that.
It also allows for updates to run while the system is online, then a fast reboot to swap which volume (snapshot) is booted from.