Not sure if linux-firmware would do that, but depending on your condiguration, security updates are installed automatically in the background.
So probably the kernel security update for the whole SpectreNG mess was installed in the background before the reboot.