Noob Question on Upgrades

I'm aware that the Ethereum network undergoes "upgrades" (like the recent Pectra upgrade and less recent Shanghai upgrade), but shouldn't blockchains be inherently difficult to upgrade? Are all of these upgrades genuine hard-forks in which somehow over 50% of the network participants agree?

In other words, I don't understand how both of these things can be true:
1) upgrades to the Ethereum network occur frequently
2) the security and decentralized nature of the blockchain are maintained.

Grateful for any and all insight.