That's just not true. I'm in Europe and all of my routers allow me to disable unattended updates and most don't enable it by default.
While it doesn't make it mandatory, it does require patching devices in a timely fasion which in other terms: requires forced updates - pushing updated firmware is not enough if you read between the lines.
Even stronger requirements come into effect at the end of 2027.