Security updates are installed automatically?

I've got two servers that are being managed by forge:

The first one runs a machine on digital ocean and when I login with ssh there are no security updates that need to be installed = great!

When I login on another server which is a custom VPS I get the message that 6 security updates need to be installed?

I was thinking that forge is doing security updates automatically or is there something I am missing?