Comment 2 for bug 745004

The prompt happens when libpam0g is configured; that's the only point at which we have reliable information about the services present that need to be restarted. If we check at any earlier point (such as with dpkg-preconfigure before libpam is on the system), we can't be sure that our list is complete since other service-providing packages may have been unpacked onto the system in the meantime as part of the upgrade.

I received the same complaint in Debian about lenny->squeeze upgrades; I really don't see any way to improve this without sacrificing robustness, unless we work on fixing the underlying services to not *need* a restart for libpam upgrades.