Took a look at the docs, this is the accepted behaviour:
Finds the record from the passed id, instantly saves it with the
passed attributes (if the validation permits it), and returns it. If
the save fails under validations, the unsaved object is still
returned.
So it does quite a bit for you: finds the record, runs the model
validations, saves it if validations pass, or gives original record if
validations failed. In this context 'update' doesn't mean 'update the
database record' it really means 'update the model object and make
sure it is valid'. To do this it must hydrate the object.
Rich C.