I encountered another weird phenomenon after installing the security update KB4018588 for Exchange 2013 CU16.
Installed CU16 for Exchange 2013 on the active database servers and everything went fine, after that installed the security update and that went fine as well.
As a good admin I stopped the maintenace mode on the servers I updated, and checked the databasecopystatus. And there it was, all passive databasecopystatusses were failed.
After some digging around in found out that the searchhostcontroller service was disabled.
Now this service is turned on by default and should start automatically and takes care of Microsoft Exchange Search.
After setting the Microsoft Exchange Search Host service startup type as Automatic and restarting the Microsoft Exchange Search service the dabasecopystatus became healthy again.