Helm Patch Service Account - Why does ArgoCD work?

Question

TL;DR: Why does ArgoCD (using Helm) apply the patch on an already existing service account (ex. default) while running Helm from the cli does not work?

On OpenShift 4.8, I want to patch a service account by linking a secret to it. For example:

apiVersion: v1
imagePullSecrets:
- name: {{ .Values.quay_secret_name }}
kind: ServiceAccount
metadata:
  annotations:
    app.kubernetes.io/managed-by: Helm
    meta.helm.sh/release-name: double-build
    meta.helm.sh/release-namespace: {{ .Values.namespace }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: default
  namespace: {{ .Values.namespace }}

It works perfectly well when run through ArgoCD (still using Helm), but running Helm through the cli:

helm upgrade --install --values double-build/values-prod.yaml --namespace XXXXXX --version v1.0.0 double-build double-build --debug

gives the follwing error:

helm.go:88: [debug] ServiceAccount "default" in namespace "XXXXX" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "double-build"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "XXXXX"
rendered manifests contain a resource that already exists. Unable to continue with install