Drupal 9 core builds are not respecting the core version

Problem/Motivation

When running a configuration like the following, we should expect Drupal core to report version 9.1.9. Instead we're getting 9.2.5, which is the current Drupal core release.

[
      'manualInstall' => FALSE,
      'installProfile' => 'standard',
      'drupalVersion' => '9.1.9',
      'project' => [
        'version' => '9.1.9',
        'shortname' => 'drupal',
        'type' => 'Drupal core',
      ],
      'patches' => [],
      'additionals' => [],
]

Whats odd is that the build does not show 9.2.5 being required.

2021-09-10T20:23:55.443Z - 613bbea008cf478cca62f0f8# /bin/sh -c composer -n create-project drupal/recommended-project:9.1.9 stm --no-install
Creating a "drupal/recommended-project:9.1.9" project at "./stm"
Installing drupal/recommended-project (9.1.9)
  - Downloading drupal/recommended-project (9.1.9)
  - Installing drupal/recommended-project (9.1.9): Extracting archive
Created project in /var/lib/tugboat/stm

And

2021-09-10T20:23:56.275Z - 613bbea008cf478cca62f0f8# /bin/sh -c cd stm && composer require --dev --no-update drupal/core-dev:9.1.9

The problem then appears to be this command which install the dependencies after we use multiple --no-update

2021-09-10T20:24:02.837Z - 613bbea008cf478cca62f0f8# /bin/sh -c cd stm && composer update --no-ansi
....
  - Upgrading drupal/core (9.1.9 => 9.2.5)
  - Upgrading drupal/core-composer-scaffold (9.1.9 => 9.2.5)
  - Locking drupal/core-dev (9.1.9)
  - Upgrading drupal/core-recommended (9.1.9 => 9.2.5)
  - Locking drush/drush (10.6.0)
...

So as we can see, the drupal/core-dev was locked to the expected version but Drupal core and scaffolding was upgraded.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes