If we had done the clean after the update, this would have been correctly removed.
When we do step 4, suddenly that directory that used to be sub-submodule is now some unknown directory that's left behind. When we do step 2, no problem, we're on the earlier commit, and that sub-submodule is tracked and retained. Let's say a submodule itself has a submodule, AND that in the new commit hash, that submodule has been removed. The problem is step 2 happening before step 4.
git submodule sync -recursive git submodule foreach -recursive git clean -ffxd git submodule foreach -recursive git reset -hard git submodule update -init -recursive.