The software does not want to allow over voltage to happen, but this is the best it can do.
To detect over-voltage, it first need to measure the voltage. Most probably it's not made at a single ADC measurement, but a few reads are averaged over a period of time for a better resolution (oversampling). Then, there are many other things that need to be run by a single processor, not only the OVP subroutine, so the subroutine that compares the voltage needs to wait it's turn to be run.
All these takes time, and by the time the software decides to shut down the output, the output voltage might have already overshoot a lot.