That does sound like a plausible cause.  The weird thing is that I
already have install_weak_deps=false in dnf.conf, and it doesn't look
like there's any separate setting for updates.

So it *shouldn't* be trying to install weak dependencies.