Chum Web directly reads the repository information (e.g. https://repo.sailfishos.org/obs/sailfishos:/chum/4.5.0.24_aarch64/repodata/32c843f1e978d4e9a9af3e98d60d3af96de835a1323237b31124ccf663cf697d-primary.xml.gz) instead of relying on PackageKit, which in turn uses libzypp to read the repository information.
Chum Web reads the file modification date of a package, which I suspect to be the date that the package is published to the repository. The file modification is then used to estimate the update time.
<metadata xmlns="http://linux.duke.edu/metadata/common" xmlns:suse="http://novell.com/package/metadata/suse/common" xmlns:rpm="http://linux.duke.edu/metadata/rpm" packages="1331">
<package type="rpm">
<!-- most properties omitted -->
<time file="1694576425" build="1694576388"/>
</package>
<!-- Packages omitted -->
</metadata>
This update time is in no way perfect, because when a new repository is created for a new Sailfish OS version, every package gets build again and will therefore be published with the same time.
As for the Chum GUI: I suspect the information goes missing in one of the libraries/abstraction layers.