The Raspbian distro kernel package is not the same as the repository used by rpi-update. The current kernel from the latter is 4.4.30, and that's what it installed.
The current kernel from the former, however, is 4.4.27. This is a typical practice: distro packages, particularly in Debian derived distros such as Raspbian, are very seldom completely up-to-date with their upstream source. WRT to the kernel, that source may be either the binary repo used by raspi-update, or they may have the same upstream source, namely the Pi kernel source code repository (meaning, both of them are compiled from that, but the Raspbian kernel is compiled separately from the raspi-config kernel).
In any case, if you did an apt[-get] upgrade subsequently, and the kernel package version has incremented since the last time you did it, it will then overwrite the kernel in the boot partition because the standard practice on the pi is to have just two installed, kernel.img (the ARMv6 one) and kernel7.img (the ARMv7 one), regardless of where they came from.
That isn't strictly necessary, since you can specify an alternative name in config.txt and switch kernels that way if you want. It does not matter what the image file itself is called as this does not impact the name used internally by the kernel (reported by uname -r) for, e.g., finding and loading modules from /lib/modules.
However, you don't need to be using rpi-update at all unless you really want the latest kernel from there. Keep in mind that a major reason distro packages lag behind their upstream sources is to allow those sources to undergo more limited testing before they are incorporated on a wider scale.
But if you do want to do that, what I do to circumvent the problem, rather than fiddling with config.txt and renaming things, is to unmount the first partition before running apt upgrade. What happens then is the distro stuff gets installed into the /boot directory, but without the first partition mounted on it, that's just a normal directory in the root filesystem. Nothing in it will actually be used when booting the pi.
By default the first partition is then still mounted normally on /boot at boot, and this will cover up what's actually in that directory. Neither of these is really needed except if you want to edit files on the first partition (such as config.txt), in which case you could mount it somewhere else if you like, and/or you want the first partition to stay updated via the package manager (apt), in which case you should make sure it is mounted on /boot (but then, there's no point in using rpi-update).
apt updatedoesn't track what needs updating by examining installed parts. It keeps a record of what it has done, so if you've already upgraded to the latest kernel, it won't do it again even if you've deleted what it installed (without usingapt). You should be able to force a reinstall withapt-get --reinstall install [package-name]but I'm not sure what the name of the kernel package is on Raspbian. Have a look throughapt search kernel.rpi-update, and it replaced what that did.rpi-updateused to check whether it needed to replace the kernel based on a tag file it left in/boot; I'm not sure what it does now, but if you run it again after runningapt upgradeit may (or may not) replace the kernel again, butapt upgradedefinitely won't do it again unless you force it to, or a new package is released.