Why unattended-upgrades upgraded so few packages, seemingly?

Most of the answer is in your unattended-upgrades logfile, located at /var/log/unattended-upgrades/unattended-upgrades.log

Here's an example:

2018-01-08 06:17:51,770 INFO Starting unattended upgrades script
2018-01-08 06:17:51,771 INFO Allowed origins are: ['o=Ubuntu,a=xenial-security']
2018-01-08 06:18:07,765 INFO No packages found that can be upgraded unattended and no pending auto-removals

Take a look at that middle line 'Allowed origins'. That means Software Repositories. The only source there is -security. Not -upgrades, not -backports, no PPAs, no third-party repos.

In other words, this example unattended-upgrades is only providing security upgrades. Nothing else.

You can add, remove, or edit Allowed Origins (repositories) through the Software and Updates Control Panel, or by editing the unattended-upgrades config file, located at /etc/apt/apt.conf.d/50unattended-upgrades.

The rest of the answer is that Xenial (16.04) is two years old. Fewer new security updates for old software.