I am not entirely surprised.
Your use of pyodbc and sending the SQL straight over to the database for evaluation, is bound to be the fastest option, as everything happens on the database server itself. Calling a geoprocessing tool inherently already has an overhead in terms of e.g. toolvalidation. In addition, but this is a bit of speculation from my side, it could well be that, in order to actually calculate the lat/long values, the da.UpdateCursor actually fetches the entire records and has them send over to your client PC. Combine that with a possible client side calculation of the actual lat/long values, and sending the result subsequently back to the database server in a row update statement, and there is both a lot more traffic and hoops to go through before you have your final result.
Anyway, maybe you can get a better insight in what is happening with da.UpdateCursor if you watch the incoming SQL statements on the server through e.g. pgAdmin (if using PostgreSQL) or a similar tool for another RDBMS.
