I would say, upgrade the backup, then reboot the backup, then change the priority on both active and standby so that the standby becomes active and upgrade the 2nd CSS.
The master takes the services back after reboot probably because you have preempt configured.
So you can try your method without preempt.
Gilles.