Stock recovery can flash root packages and custom recovery ZIPs but not custom ROMs

This question might seem to be a duplicate of [this question](https://android.stackexchange.com/questions/24525/why-is-custom-recovery-a-prerequisite-for-flashing-a-custom-rom) but it is different. But I'd like to have a brief explanation on why we need a custom recovery to flash a ROM. My main points of confusion are: 1. In stock recovery we have a option to "*Install Update from SD card*". Why can't we directly flash a ROM from there? 2. If signature verification is the problem regarding the first point, then how can we root and flash custom recovery using update from SD card? Why doesn't any signing or verification problem occur while flashing root package or custom recovery package? Like any other custom ROM package they are also unsigned. Why is this?