I just went thru the same issue with my 4 host servers reading as "Non-compliant" when I scanned & remediated via Update Manager. I didn't let it go because I wanted to know that everything was working as it should with regards to Update Manager - Because I had just upgrade vCenter and each of the hosts from 5.0 to 5.5 and then focused on ensuring Update Manager was all set up for the future updates.
Longer story shorter... after three tech's and two weeks of waiting because I wanted the ESX 5.5.0 imported ISO to show as compliant on my hosts, I spoke to a third and final tech who made it more clear to me.... not sure if I just wanted it to be clear so I could finally just accept it and move on.... but, it worked for me 
Hope this is your solution as well...
When you have Update manage configured to download updates on a scheduled basis as I do, those updates appear in the "Patch Repository" tab with Update Manager's Admin view.
When you import a newly downloaded ISO (I tested both the Dell ISO & the VMware ISO with the same results), and attach to a host, it is compared to the updates within the "Patch Repository" , causing the attached ISO baseline as non-compliant. The way the tech put it was to compare it to a Microsoft CD, as soon as it ships, there are updates to it (don't we all know that). The mounted ISO, when you've installed via CD and then import and attach as a host baseline, will show as non-compliant when you have newer patches downloaded by Update Manager. Simply because the ISO will always be out of date compared to the patch repository contents.
So, he showed me that after I imported the ISO, attached as a baseline to the host and ran a scan/remediation/Install/reboot - It showed as non-compliant because I had newer patches for that same ISO version in the patch repository - He said, do the scan/remediation/install/reboot on the ISO, then after the reboot, remove the baseline from the host and add the critical and non-critical patches (not ISO) to the host, then run the scan/remediation/reboot/install on the host and you will see the patches are all reporting as compliant.
Worked for me! I used the ISO just for the simplicity of deploying the U2 update, then removed the baseline and now rely solely on the critical and non-critical to show proper compliance.
As a side note, my NetScaler broke after migrating it to a 5.5.0, 2143827 host - I migrated it back to the 5.5.0, 2068190 (U2 only) host and it works again - no solution currently.
