lspci uses a community driven PCI database which might contain errors.
You may want to download its latest version and overwrite your Debian file (it's 100% safe) and see if the error has been fixed. If not, please submit new correct information.
Another possibility is that this particular device is shared between 8th generation and 9th generation CPUs, so it's shown to be the 8th generation though I've never seen Intel do this before.