To anyone who also unfortunately had this happen in a production environment.
Add this to prevent automatic updates wp-config.php
define( ‘AUTOMATIC_UPDATER_DISABLED’, true ); ?
define( ‘WP_AUTO_UPDATE_CORE’, false );
And in functions.php
add_filter( ‘auto_update_theme’, ‘__return_false’ );
add_filter( ‘auto_update_plugin’, ‘__return_false’ );
Some of these may overlap, but you can never be too sure with wordpress, mine decided to update in production even when I only had the “automatic updater disabled” checked. So now i added them all ??