(Refer: https://github.com/vyos/vyos-1x/blob/24d259e57b52eda16f357c5de7c3cb23ac69a18c/src/op_mode/image_installer.py#L552, current at time of bug report)

add system image <url> vrf <name> works as expected, as the script-local download_file() wraps curl in an appropriate ip vrf exec.

If the URL is "latest", the script attempts to fetch update metadata from a configured update-check URL, via a direct Python requests module call from vyos.version.get_remote_version().

The update-check always happens in the VRF context of the calling shell (usually, global), rather than the VRF it was directed to use for downloads, which will probably interfere with any instance a specific VRF is required for updating.