Is it normal that a site changes to maintenance mode during a module update?
It does look to be normal, yes. Drush's UpdateDBCommands::updateBatch, which is responsible for processing the updates, contains this:

batch_set($batch);

// See updateFinished() for the restore of maint mode.
$this-&gt;maintenanceModeOriginalState = \Drupal::service('state')-&gt;get('system.maintenance_mode');
\Drupal::service('state')-&gt;set('system.maintenance_mode', true);
drush_backend_batch_process();


The code deliberately sets maintenance mode to true before processing the batch, and then restores the original state when it's done.

Running drush help updb lists the following options:


--cache-clear[=CACHE-CLEAR] Clear caches upon completion. [default: "true"]
--entity-updates Run automatic entity schema updates at the end of any update hooks.
--post-updates[=POST-UPDATES] Run post updates after hook_update_n and entity updates. [default: "true"]
--no-cache-clear Negate --cache-clear option.
--no-post-updates Negate --post-updates option.


So there doesn't seem to be an obvious way to disable the behaviour. But if you're updating the database you probably don't want people to be able to access the site at the same time. There's a good explanation for that here.