Magento 2: Origin of the Update Folders

Full details are in this old article (self link), but here's the high level overview.

When you say

composer create-project --no-install --repository-url=https://repo.magento.com/ magento/project-community-edition my-magento2

you're telling Composer to download the magento/project-community-edition package and drop its contents directly in the my-magento2 folder. In addition to containing the composer.json file with all the Magento 2 packages listed, the magento/project-community-edition package includes the updated application in a top level update folder.

It is part of the project-community-edition zip file. If you look into it (easy to get from composer cache dir), you will see the following:

composer.json
update/
.gitignore