Magento 2: Origin of the Update Folders

Full details are in this old article (self link), but here's the high level overview.

When you say

composer create-project --no-install --repository-url= magento/project-community-edition my-magento2

you're telling Composer to download the magento/project-community-edition package and drop its contents directly in the my-magento2 folder. In addition to containing the composer.json file with all the Magento 2 packages listed, the magento/project-community-edition package includes the updated application in a top level update folder.

It is part of the project-community-edition zip file. If you look into it (easy to get from composer cache dir), you will see the following: