While you are generally correct, in this case the release notes labeled this as a security update and not an OS upgrade. The fault for this is Microsoft's not the sysadmin.

Many distros (at least Ubuntu) auto-installs security updates, and here a mislabeled "security update" was auto-installed. This is not the fault of the sysadmins.

There's a lot of people out there running automation to keep their servers secure. Well I agree any automation out there should be able to flag and upgrade excluded, It would seem to me like Microsoft should own some of the blame for a full ass hard to uninstall OS update fed in with the same stream and without it interaction. I kind of expect my OS in stall pop up a window and say hey a****** this is going to upgrade your system, are you cool with that. I don't know how it works these days but I know back in the day going between versions you would have to refresh your licensing on a large upgrade.