As per case 4747082:

If a Windows asset has new (non-superseded) patches installed and is scanned using a detect only schedule that uses a label containing superseded updates which have NOT recently been deployed to the asset, these patches are incorrectly detected as required.

Looking in the logs, it is evident that Kace calls dism to only look for the package in question and not packages that Kace knows supersedes it.

The result is that it is impossible to completely rely on detect only labels to generate reporting for accurate compliance.