There's an Android update and a security update - 2 separate things. They're usually combined into one update. But in September 2019, Google came out with 2 updates, almost at the same time. (And I mean, I downloaded one, looked up and there was another one - minutes apart.) If AT&T is running a little behind, it could be that second security update. You can see them both at
https://source.android.com/security/bulletin/2019-09-01 - one for the 1st, one for the 5th. They're on the same bulletin, but the updates were issued separately. (I hope the second was cumulative - I didn't flash the first one.)