With this commit
checkAccessControlOnUtilizedColumnsOnly was updated to be true
However for UPDATE queries, we do NOT have an implementation of the UtilizedColumnsAnalyzer#UtilizedFieldsBuilderVisitor (coderef)
Because of this, the Set<String> columns to the checkCanSelectFromColumns is an empty set, and no columns are checked by access control
This will also impact DELETE queries