Confusion over DDM-enforced iOS updates on unsupervised devices in Intune + Apple Business Manager

How come, that in the Intune + Apple Business Manager setup, the policies that enforce device system update using Declarative Device Management, apply also to non-supervised devices? This is the side result of our pilot deployment of ABM. We can see that on unsupervised devices, that are covered by the policy, the behavior is identical in terms of enforcing iOS 18.5 to iOS 18.6 version (prompts, update download, increased frequency of prompts, finally the prompt where it's possible to only install or choose "Emergency call").

At WWDC 2024 (see What’s new in device management - WWDC24 - Videos - Apple Developer) DDM was explained as allowing pushing updates to supervised devices only. Since when it is available to enforce updates on unsupervised devices?

And it clearly is available: for example About software updates for Apple devices - Apple Support (IL) states

"Users may also need to agree to updated terms and conditions to initiate a software update or upgrade on their devices. This doesn’t apply to updates device management enforces on supervised devices." - which implies it affects unsupervised devices.

I was not able to find any clear Apple documentation explaining then as of August 2025, pushing iOS system updates to devices using DDM, should be possible. If so, ability to enforce iOS updates installation on unsupervised devices would be a great news for our Security team, but this is so opposite direction from what Apple has been doing with shifting more and more capabilities under supervision, that I don't dare to jump in joy yet.

[Re-Titled by Moderator]