And you can. Doesn't mean all your users' personal devices comply with the request to do so.
On iOS? iPhones don't update automatically (if you tell them not to), but I'm not aware of a way to stop them from downloading updates, other than weird workarounds like installing a tvOS beta profile.
I forget that perhaps Apple's intent is to do what people complain about: download the update anyway, regardless of the setting. My anecdotal experience (I have yet to have an iOS device actually download the update when I have automatic updates turned off) allows me to forget.
How about silent updates, like the one Apple pushed to remove Zoom's ghost server last year?
Those are non-executable rulesets that are part of XProtect, the system-level antivirus. It’s not an OS update.
Actually, my iphone won't update unless it's being connected via WLAN rather than WWLAN. Makes me kindof of a persona non grata at friends where I have a WLAN password, and the first thing happening if I'm on a visit is that my iphone updates itself. Though it's not as bad as people with Windows notebooks exhausting my mobile plan when they're at my place.