Restart required with antivirus/antispyware component only

I'm a little bit confused... I'm upgrading clients from 12.1 RU1 or 12.1 RU2 to 12.1 RU3.

I thought that if a client had only antispyware/antivirus component (no NTP, no Firewall, nothing), restart was not needed.
My clients, instead, reports Restart Needed if I open the SEP and in the tray the icon shows the well known yellow dot.

What is happening?