The mystery is solved. The typescript version is pulled in by tslint
and in turn by the internal gulp-related typescript.
The output of "TypeScript version: 2.1.6" happens when the tslint
task starts a typescript compilation:

Looking at the "package.json" in "node_modules/@microsoft/sp-tslint-rules" I can see this typescript dependency:
"@microsoft/gulp-core-build-typescript": ">=2.2.5 <3.0.0",
Now looking in "package.json" of "gulp-core-build-typescript" I see this typescript dependency:
"typescript": "~2.1.4"
This means: the highest typescript version starting with "2.1" will be used.
Looking at the available typescript versions shows "2.1.6" as being the highest one available:
npm view typescript versions --json

So that's why the version is 2.1.6. And since it's part of a chain of packages working together I won't touch it.