The reason is because you are using offline mode. Offline mode scans for security updates updates against the wsusscn2.cab file from Microsoft, which does not contain every update that is published on Microsoft’s public update servers.
Other possible reasons for a discrepancy are outlined in the second question on the FAQ
Thanks for the quick response Doug. I guess I was expecting more than just two updates on the newly installed system from an ISO dated in 2016. Sounds like I’m going to be back to using a standalone instance of WSUS on a laptop then if I want to completely patch a new install of an OS. I guess that is one of the disadvantages of me having an air gapped network of machines.
Updates are now cumulative, so when patching an older machine you won’t have the large number of updates that you would have had prior to when Microsoft started releasing cumulative update packages.