wp-cron is blocked, but the site is still auto-updated

For some reason, one of my WordPress sites has the .htaccess file so that Apache denies access to wp-cron.php. It seems to be working as intended, since there is no record of wp-cron in the access log. However, the site was suddenly updated from WordPress6.0.2 to 6.4.1 automatically. I do not use any plugin to do that. I do not use Linux cron. Is there anything else that could cause this update? Is it possible to auto-update without wp-cron or cron?