I don’t think this is actually true, unless something has changed since: Installing package seems to update everything unintentionally? - #9 by kristoffer.carlsson I share OPs view that its kind of unintuitive, but I’m guessing solving this is a harder graph theory problem than I realize.
In any case, assuming this hasn’t changed, I think the solution for now is 1) either pin things you for sure don’t want to update or 2) version control your Manifest.toml so you can always roll back if something broke.