Two sites with the same version of WordPress end up on two different releases after autoupdates: one takes a security patch, the other jumps a major version. Both outcomes are decided by an option you never see or set.