Reproduction:

• Create a branch
• In a submodule commit some changes
• Commit the submodule commit ref change in the parent repo
• Merge the branch into another branch
• The merge commit contains the correct submodule commit ref, but the submodule is currently set to the old commit ref, and is listed in the working copy changes

TL;DR: When merging a branch with submodule changes, we always have to reset the submodule afterwards.