Two core security releases in five days, and the second one is the bad one. 7.1.2 went out on the 22nd for a page-template bug in core that needs no account and no click, and Patchstack was seeing probes for it the same afternoon. CISA added it to the KEV list on the 25th. If you patched to 7.1.1 last week and stopped there, you're still open.

The reply I keep getting when I bring this up is "auto-updates are on, we're fine."

Go open wp-config on the site you're least worried about. If there's a WP_AUTO_UPDATE_CORE set to false in there, left over from some migration or a dev who wanted control back in 2021, that site hasn't updated itself since 2021, and nothing in the dashboard is going to tell you. Same with DISABLE_WP_CRON when the host promised a server cron, and nobody ever set one up. The update check simply never runs. The site sits there looking maintained.

I ran wp core version across ours yesterday instead of trusting the version number on the dashboard. I don't normally do that. I probably should have been doing it for years.

What actually bothers me is who ends up behind. Not the neglected side project on cheap shared hosting; that one auto-updated on the 22nd without anyone noticing. It's the client site with change control and a staging step, where the 7.1.2 ticket is still waiting on a reviewer who's on holiday until Monday.

Did you check every site you're responsible for, or did you see the auto-update line and move on? I'm asking because I'm not sure which one I'd have answered a month ago.