Currently, if one reads the box_update() docstring it says
Updates the box matching name and provider.
Which is not necessarily true, that will check the machine (so far I was able to reproduce) and not the box name that local VagrantFile defines.
I'd recommend extending the command so at least --box could be provided instead. Maybe an extra parameter? Could be box_name or vm_name, and with that one decides how it wants to approach it.
Also, provider is not really mandatory