Took a look at the docs, this is the accepted behaviour:
Finds the record from the passed id, instantly saves it with the passed attributes (if the validation permits it), and returns it. If the save fails under validations, the unsaved object is still returned.
So it does quite a bit for you: finds the record, runs the model validations, saves it if validations pass, or gives original record if validations failed. In this context 'update' doesn't mean 'update the database record' it really means 'update the model object and make sure it is valid'. To do this it must hydrate the object.
Rich C.