Why does the SQL Server build number sequence not correlate with the release date sequence?
Build 13.0.5101.9 - released 9/07/2019 is
https://support.microsoft.com/en-us/help/4505220/kb4505220-security-update-for-sql-server-2016-sp2-gdr-july-9-2019
Build 13.0.5102.14 - released 11/02/2020 is
https://support.microsoft.com/en-us/help/4532097/kb4532097-description-of-the-security-update-for-sql-server-2016-sp2-g
These are General Distribution Release (GDR) builds, intended to be installed by all customers running the affected Service Pack level.
Basically, those are critical patches for SQL 2016 SP2 which don't require installing any of the Cumulative Updates.
The relevant fixes would also have been included in the next CU, and probably available as a hotfix for the current CU.
As for the build numbers, GDR is a seperate branch from CU.  It's tricky to apply a single build number system to a branched codebase, but the strategy appears to be that the GDR build numbers are placed between the common root build number (SP2) and the first CU (SP2 CU1).

if I upgrade my system to 13.0.5149.0,

That's CU1, and once you are on the &quot;CU Train&quot; you must apply subsequent CUs to get fixes.  That's why the KB's say

To apply this update, you must have SQL Server 2016 SP2 or any SQL
Server 2016 SP2 GDR release through this SQL Server 2016 SP2 GDR
installed.