My default update vm was sys-net1 (the name when restored from backup).
I have renamed it to some other value: sys-net
Then the updates did not work for templates.
After checking, the line in the /etc/qubes/policy.d/50-config-updates.policy
qubes.UpdateProxy * @type:TemplateVM @default allow target=sys-net1
was remaining as the old value. After manually replacing the value, updating resumed to work as expected.
HTH