“the Combo update reverts XProtect and other configuration files to those which came with that update”

Link. Yikes. What an obscure problem. See post for workarounds.