If the string "AA" does contain "A" OR does not contain "B" evaluates to true. The OR is the keyword here, only one clause must be fulfilled and in this case, "AA" does not contain "B" is true so
the other clause ("AA" does not contain "A" is meaningless).
This is ultimately a limitation/shortcoming of the in console query feature as it always adds an OR when adding the same field multiple times as what you really want here is an "AND".
You will have to find another way to accomplish your goal. Without knowing what your purpose is here, I can't offer much. One suggestion though is to find the updates you want to exclude and move them to a folder. Then, any subsequent queries on the "All
Software Updates" node won't contain those updates at all without even including any criteria.