Running yast online update lists nothing to install.

Running zypper up gives
The following 290 package updates will NOT be installed:
...
37 packages to upgrade, 4 new, 2 to remove.

This is confusing and means one can't easily install security patches via
console. (yast-console isn't so user-friendly.)

On a system that has essentially only repos and packages added that behaviour
is unexpected. My expected behaviour is that patches offered for installation
are identical regardless whether I use GUI or zypper.

The 290 packages seem to be the "optional" patches list. The 37 packages seem
to come mostly (all?) from additional repos like graphics, publishing, or
toolchain-avr. Why are those additional repos treated differently?

I don't see how changes to zypp.conf with these variables could cause this:
commit.downloadMode
download.media_preference
download.min_download_speed
download.use_deltarpm
multiversion.kernels
repo.refresh.delay
solver.upgradeTestcasesToKeep
That's all about how packages are downloaded, not which are installed.