Update disabling is still there - gated behind more expensive editions and enterprise policy settings, because Microsoft likely had gotten a bad reputation in the past for systems with updates disabled becoming botnet nodes due to vulnerabilities.

In a way, the restrictions which used to be exclusive to Home are now part of Pro, the more expensive Pro for Workstations is what Pro used to be and Enterprise (also available through a per-user subscription model instead of a per-machine model, cheaper in a way for individuals with 5 PCs nobody else uses) also has some extra toggles not removed.

I think the subscription versions also include an Intune license which is the only supported way (other than installing third-party AV) to disable Windows Defender permanently, as well.

Now, MDM-managed Apple phones still come with a number of core restrictions, though I believe there's more loose side loading on there - however you have to register Apple hardware into MDM at purchase time as only authorized resellers can grant this access to a serial number.