How does the allowAutoUpdates setting differentiate?
Craft's version numbers follow this pattern:

major.minor.build

So your update was a minor update and you could have blocked it with the settings build-only or false.