Turns out this weird behavior I reported has to do with how I've been testing my code. I would first register the new user ONE TIME, but then after that, to repeatedly generate the aforementioned sequence of events, I would just set both Confirmed and Approved to No in the site back end user profile and then click the confirmation email link and re-approve the user in the front end. Apparently, this is NOT equivalent to starting all over with a new registration request since, when I do that, my update query works and the profile field values stick.
So this is an interesting thing to note when testing these events both in CB Auto-Actions and also in custom plugins. Now I know.