I am particularly concerned their remediation includes disabling auto-update with no discussion of how they will replace it. I was operating under the assumption that updating the OS for the customer is table stakes for a managed platform.
That's an interesting one, I wonder if they have self-baked jobs or they had misconfigured `unattended-upgrades`.
In both cases randomly upgrading production environment to major version is something that should be done with a lot of extra care and testing.