By default WordPress applies minor and security releases of core automatically. Updates for major core versions, plugins and themes can be turned on through settings, configuration or code, and many hosts add their own policy on top.
Several things can stop them silently: a constant or filter that disables updates, file permissions that prevent WordPress from writing files, a scheduled task that never runs, or a site directory that looks like a version control checkout. A site can therefore appear to be on automatic updates while remaining unpatched.
Do not assume. Check Site Health, confirm the installed version against the latest security release, and keep a manual update routine as a backup for important sites.