Thank you, that’s very clear.
There are exceptions though, most prominent being
glibcmarking/etc/nsswitch.confas%ghostcausing it to survive update.
That was the first one I ran into.
If you find a package that does something different, I would say it is the topic for bug report.
Possibly with shadow. I’ll investigate and triple check before filing a report.