The recent security updates to grub inspire two questions:
1) Do the changes require updating the info put in the boot sector?
2) Does the upgrade do that installation automatically?
I couldn't find documentation that addressed either issue, though I think the answer to 2) for my system is yes.
When I did the upgrade the terminal showed
-----------------------------------------------------
Setting up grub-pc (2.02+dfsg1-20+deb10u1) ...
Installing for i386-pc platform.
Installation finished. No error reported.
Generating grub configuration file ...
--------------------------------
The second line suggests an installation happened, though it's not clear. In particular, it doesn't mention any particular installation location.
Mucking around in the scripts,
/var/lib/dpkg/info/grub-pc.postinst includes
if grub-install --target=i386-pc --force --no-floppy $real_device ; then
and grub-pc/install-devices is set to a plausible value in /var/cache/debconf/config.data.
So my guess is it is installed there. But I'm not sure the actual execution hits that code path.
It is perhaps reassuring that "Installing for" does not occur in the postinst script, so that it seems likely to have come from the invocation of grub-install.
Thanks.
Ross Boylan