the binary may have been installed already, i.e. a install without UPDATE=1 (done so that everything gets reinstalled). The schg flag is not unsettable, even by root, at securelevel 1. A flag like this should be set by mtree, not install.