This is the flip side to this issue: http://drupal.org/node/80526
According to chx on IRC (and webchick on the issue above) - all core updates MUST be in system.install - anything else risks serious loss of user data because updates for versions more than 2 ago are dropped - if you disable a module (e.g. comment module on Drupal 5) and then re-enable is much later (e.g. on Drupal 9) than the update code will be gone. Since the updates in system.install always run - even for disabled modules - the problem is avoided.
Perhaps in D7 a mechanism can be devised to circumvent this problem, but for D6 it's unavoidable at this point.