May be Hotfix and Patch are in ePO current branch that's why VSE was upgraded to latest Hotfix and Patch. Move packages to Previous and Evaluation branch which will fix this issue.
Hmm .. this is not for VSE tho.
HIPS and EPM. Not MA
Funny thing this also applies sporadically. Most machines gets updated and some are not.
VSE is just example, if you keep other product's patches and Hotfixes those will also get during daily DAT update process, So keep them in ePO other branches.
check the McAfee Agent standard Policy, specifically the register "Update".
Within this one you can determine which product should take its update from which tree (VSE8.7i for example can take its Updates out of the evaluation tree whereas VSE8.8 can be configured for taking the updates out of the actual tree) . Maybe there is the problem.
Yes, Correct you can update in this policy.