In this case it's saying that this server needs flash player, but flash player isn't installed on this server,
This is a never-ending state of confusion with terminology used. The graph does not say that the package is *needed*; it says that the package is Not Installed. (on the left). That's a factual statement. Because the package in question is not an *update* package but rather a full-product installation package, it will report as "Not Installed" on any system where it is not installed.
The other way to deal with this is to publish only the (Upgrade) package, and not the full installer package. In that case, the package will be Not Applicable on systems that do not have the product already installed.
On the Summary Status, "Needed" is a consolidated count of three separate states: "Not Installed" + "Downloaded" + "Pending Reboot". The term "needed" has long been an unfortunate choice that Microsoft made oh so long ago, but the key is in not interpreting that term so literally. The only entity that determines whether an update is NEEDED is the patch administrator. Otherwise, you should consider the word "Needed" == "Not Installed", and nothing more than a factual observation of the state of the machine, not an interpretation of what should be done with the package on any particular machine.
Is there a way to make this show that it's all updated?
On those graphs, no; but if you look at the next tab -- Approved Update Summary -- you'll get the view you're looking for, which is filtered by only those updates authorized for installation on the target system.
Thanks for the clarification.