Windows can perform updates even when Wi-Fi is turned off due to the way updates are managed. When your device is powered on, it can check for updates that were previously downloaded and stored locally. This means that if an update was downloaded while the Wi-Fi was on, it can be installed during the next boot-up or restart, even if the Wi-Fi is turned off at that moment.
Additionally, Windows updates can include critical updates that are necessary for the device to operate properly. These updates may be scheduled to install automatically during specific times, such as during a reboot or when the device is not in use (like at 3 AM). This is part of the update behavior designed to ensure that the system remains secure and up-to-date without requiring constant user intervention.
As for your concern about updates happening without your explicit permission, Windows is designed to manage updates automatically to protect the system's integrity and security. However, you can manage these settings through the Windows Update settings to defer updates or change how they are installed if you prefer more control over the process.
References: