Spam updates are not core updates.
A core update reassesses how well content answers a query relative to everything else on the web.
A spam update improves the automated systems that identify sites breaching Google’s spam policies: scaled content abuse, site reputation abuse, expired domain abuse, link schemes, cloaking, doorway pages, hacked content and the rest.
Sites caught by those policies rank lower or drop out of results entirely.
The distinction matters because the recovery path is different.
If a core update moves you, the answer is usually “make the content better and wait for the next core update”.
If a spam update moves you, the answer is “find the policy breach, fix it, and wait months”.
Google’s own guidance is that its systems need to observe a site complying with the policies over a period of months before it recovers. Months, not weeks.