I have not seen this issue. I don't think it's the job of update-grub to create those symlinks in the root. I'm guessing those are created by a post-install script in the debfile from which the kernel is installed. How was the new kernel installed?
Hold on! My last kernel update seems to have created the symlinks not in root, but in /boot! vmlinuz and vmlinuz.old are in /boot, pointing to the appropriate files also in /boot. Same with the initrd links. I wonder if this is just part of some effort to clean up the root directory? Everything seems to work fine...
Do you have the links in /boot? You might try re-installing grub - something I read indicated that is responsible for the links, not just update-grub.
I also read that Debian no longer creates those links in root, but a reason wasn't given. I'm sure a bit of searching would reveal the whole story.
You might want to delete (rename temporarily, in case you need 'em back) the links you have in root, and re-install grub:
I'm afraid I'm not really an expert on this. It seems to me that the system of having a vmlinuz/initrd symlink is changing. I have no symlink in /, only in /boot. And my grub.cfg linux and initrd stanzas point directly to /boot.
I have done nothing 'manually' on this installation - just let apt update/upgrade take care of things. Perhaps try reinstalling grub if you haven't already, followed by an update-grub.