We have a managed package that has several profiles in it. Every time we install the package, we have the option to choose what profile in the package should have access to what profile in the org. However, I have noticed that it only works the first time we install the package and has no impact on updates. Why is it still there when updating? Is there a benefit?
Profiles are not upgradable, so you can install them from within your package if this is a first installation, but if you are upgrading your package, and the profile exist allready, it won't be upgraded.
If you do want to upgrade security settings, you'd better use permission sets, see this doc.