The TemplateUpgradeService has a high level flow of:

• receive ClusterChangedEvent
• check preconditions (global block, master node, etc)
• gather necessary updates from registered upgraders (plugins)
• apply template updates on the generic thread pool.

However

• the ClusterChangedEvent comes in with the same ThreadContext as the action that triggered the event (which might be a node join/leave, but it also might be a settings change or index create/delete over REST).
• The generic threadpool execute preserves the ThreadContext from the calling code.

Consequently, the template update runs with a ThreadContext that matches the original triggering action.
If X-Pack Security is enabled, that means that update which should run as _system might attempt to run as the user which authenticated to the Rest API. That user may not have privileges to perform that update.