To be fare, this time if users left on auto patching, they would have received the prerequisite uodates from 2019 - Alot of these reports are coming from people who use SCCM etc for patching and think a CU update should contain everything you need.
Its all a great big balls up for sure.