you are mixing up two things:
- if the PVE packages are upgraded, services are restarted/reloaded/left-alone as needed by the package maintainer scripts that are executed before/during/after upgrades, including things like a pve-container upgrade triggering a reload of pveproxy/pvedaemon even though the latter is shipped by pve-manager
- if random library X is upgraded which some PVE service(s) might use, they are not restarted/reloaded automatically
for the latter part, you need to setup needrestart (or reboot the whole host), but you need to mimic what the packages themselves do on upgrades else things will break:
- for some services, the right choice is restarting the service (because they are safe to stop and start)
- for others, the right choice is reloading the service (else, running tasks/.. would get interrupted!)
- for another set, the right choice is to leave them as they are, as there is no reload support and restarting them would cause guests or other important parts to be killed (e.g., networking.service, the services representing individual guest instances, dbus things, ..)
note that some services will periodically reload themselves anyway (e.g., when rotating logfiles, or after a certain time, or after a certain memory usage threshold)
