Holy crap, thanks to @Nevada-Williford for the hint. Going in and setting my System.Web.Mvc reference to <Private>True</Private> (Copy Local = True) fixed it. Note, that before the update everything was working, after the update I had to modify my csproj to get it working again.
Working theory on what’s going on:
Copy Local = True and <Private>True</Private> used to be almost, but not exactly, the same thing. The former was a Visual Studio setting, the latter an msbuild setting. If the msbuild setting was absent, the Visual Studio setting would be applied (as long as you were in VS). In this update I think they changed it so Copy Local just reflects the presence attribute.
In our project we do not have that attribute set explicitly but Copy Local = True so prior to the update System.Web.Mvc.dll gets copied to the bin directory. After the update, since the attribute is missing Copy Local shows False and you have to set it to True to make sure you get a local copy.
Manually setting Copy Local = True (or adding that xml element to msbuild) fixes the issue.
Edit: While this appears to be the answer to the specific question, anyone coming here should read the comment thread and other answers – especially dmatson’s – for more context, caveats, and related bugs.