When the kernel is updated, a reboot is necessary to load the new version. Improvements and security fixes aren’t implemented until a reboot. Services and daemons likewise need restart to ensure they’re working. When libraries are updated (OpenSSL or Gnutls for example), they might get run with the wrong version of an application.