git submodule update needed only initially?

As mentioned in my previous answer to git submodule update, that command checks out the specific version of the project, base on their .gitmodules file.

The GitPro page does insist:

This is an important point with submodules: you record them as the exact commit they’re at.

You can see which commit is referenced by running within the "super project" (the one referencing one or several submodules):

• git submodule status (except if you did some commit directly within that submodule, thinat case it will show a "+" in front of the SHA-1 of the HEAD of any submodule that has advanced from the SHA-1 stored in the superproject) or
• git ls-files --stage looking for entry in mode "160000", a special entry in the Git index.

That means, each time you execute a git command in the "super project" which could modify that submodule commit SHA1, you need a "git submodule update".

do I need to "git submodule update" only when I first clone the superproject, or after every pulling of the submodule (from its own repo)?

Yes, you have to do this every time you pull down a submodule change in the main project.
That is because you are referencing the exact commit the submodule original repo is at (as said above), and when you pull that repo, you are effectively modifying that commit.