WP core updated forcibly

Hello!

I’m aware that WordPress could automatically (I’d say forcibly) update it’s core if the website admin is not taking care of updates. It happens after multiple major releases. Could someone please tell me where exactly that information posted (how it works and after what versions that update happens)?

The story behind this: I’m was reviewing a website that was not updated for at least a year (most likely two) and one day the owner of the website angry emailing me about his website’s WP core was updated and that caused some code issues. I know that I did not update WP core, and he is telling me that he did not either. But he blames me for that update and I’m trying to defend myself, but I could not find any official information (from the WP core website or any trustworthy resource) about that process and how exactly it works.

Any advice would be much appreciated.
Thank you!