I could bet that the first line in there is
$type:TemplateVM $default allow,target=sys-net
and your statement
directly from sys-net would still be wrong. It’s not directly, as I pointed out. Template gets its updates from sys-net via
RPC/qrexec. Directly would be if you’d set sys-net as netVm for a template, which is exactly what one wouldn’t want to do.
Why would you expect your updates come from sys-firewall if it’s not set in
qubes.UpdatesProxy and why do you think it would be safer if it comes from sys-firewall (again - not “directly” but via RPC/qrexec)?
How do you now this if
$type:TemplateVM $default allow,target=sys-whonix
is set in