Welp, it was a bug after all: https://www.engadget.com/cybersecurity/apple-rolls-out-ios-2...