Checked XProtect.meta.plist inside the app bundle, forcing an update check with softwareupdate has no impact either.

Perhaps it’s a staged rollout, but at least on my iMac there’s no sign of updated signatures.

Yeah you’re just looking at the version of the xprotect binary, not the malware signature data files, which don’t live in the bundle and get updated more regularly.

They also ship silently via system_installd, you’re not going to see anything in the software update GUI

The signature files also live inside the XProtect.app bundle, unless in true Apple fashion they’ve got other stuff that’s lurking elsewhere in /System that I can’t locate.