On iOS? iPhones don't update automatically (if you tell them not to), but I'm not aware of a way to stop them from downloading updates, other than weird workarounds like installing a tvOS beta profile.
I forget that perhaps Apple's intent is to do what people complain about: download the update anyway, regardless of the setting. My anecdotal experience (I have yet to have an iOS device actually download the update when I have automatic updates turned off) allows me to forget.
How about silent updates, like the one Apple pushed to remove Zoom's ghost server last year?
Those are non-executable rulesets that are part of XProtect, the system-level antivirus. It’s not an OS update.