I have been pursuing this issue via other avenues, and I have found that if you are on a computer managed by an RMM (ie a company computer with enforced update policies), the RMM can and will push through an update regardless of the policies you have...