After you install a security update, you may be prompted to restart your computer if one of the following conditions is true:
The security update updates a DLL that is loaded in one or more processes that are required by Windows. The security update cannot be completed while the DLL is loaded. Therefore, the security update must stop the process that causes the DLL to be loaded. Stopping the process will unload the DLL that is required to complete the update. However, the process in which the DLL is loaded cannot be stopped while Windows is running. For example, the security update that is described in security bulletin MS04-011 updates many DLLs that are loaded in core operating system processes that cannot be stopped without shutting down Windows.
The security update updates an .exe file that is currently running as a process that is required by Windows. The update cannot be completed while this process is running. However, you cannot force this process to stop unless you shut down Windows. For example, Csrss.exe is a required process in Windows.
The security update updates a device driver that is currently being used and that is required by Windows. The update cannot be completed while this device driver is being used. However, you cannot unload this device driver unless you shut down Windows. For example, Disk.sys is a device driver that is required by Windows.
The security update makes changes to the registry. These changes require that you restart your computer.
The security update makes changes to registry entries that are read only when you start your computer.
So now you know. The McAfee details may differ, but the principle is the same.