I wondered the same, but I'm assuming it's just a faster way for the vendor to ship an updated .ko to a known kernel. That is, for existing phone myphone3a-variant7 there is an existing kernel 5.10.123-myphone3a-variant7 and the vendor wants to fix a bug in it; they can either ship a whole OS update containing 5.10.124-myphone3a-variant7 or they can build 5.10.124-myphone3a-variant7, pull out the one .ko that actually changed, stick that in an APEX update, and ship that, thereby getting the update out much faster and with less (no?) action on the part of users.

At least, that's what I'm guessing; I can't tell for sure either:P