A lot of times the Play Store updates what it considers 'critical' system apps even with the setting turned off (never auto-update apps). Also some apps get 'server side' updates where the UI can be redesigned to fit with say, the Android 12 "Material You" look, even without actually updating the app--Google apps are commonly updated server-side. I never updated Maps on one of my tablets that runs 4.3 Jelly Bean but it has the design of Android 9.x even though the app never got updated and has the older, Holo UI icon.
Annoys me to no end. I hate redesigns especially when they're downgrades visually, and when they move things around where I have to rediscover them it breaks my flow. That's why nothing I use today has the Play Store, or Play Services and no Google Account. I don't trust them to not change something even on 2.3 Gingerbread so I err on the side of caution and ditch any chance even to the point of disabling the download manager (most apps such as Amazon Music, Dolphin Browser, Samsung Internet, Kindle, etc don't need the system download manager since they have their own managers) so noting can download without permission including system updates. I no longer believe in updates after being burned too often by them.
For example, even without a Google account, my Galaxy S4 updated everything due to Play Services doing its malware-magic (look at its permissions and tell me it ain't malware) and the only way to permanently undo it was to uninstall all updates and disable both Play Services and the download manager.
Many people on forums think I'm stupid and tell me how I'm gonna get hacked running such 'outdated software' but for some reason, the 'outdated software' feels far more futuristic and works for me best. Why they care what I do with MY PHONE is a mystery. They feel outright threatened by the fact someone out there uses their Galaxy SII as a daily driver in 2022.