Core component of SQL Server for storing, processing, and securing data
There is no auto-update of Cumulative Updates by default. So if this happening, it is because it has been configured in your environment.
GDRs for SQL Server comes with Windows Update, but if you only have the RTM version, you will be on the "RTM train", so you will get a GDR for RTM. But once you install a CU, the GDR update you will be offered will be CU6-GDR, as that is the most recent GDR, as I recall. I don't think there is a setting for Windows Update that will give you CUs. My guess is that you are in a corporate environment, and your IT folks have set something up.
As for the configuration option "automatic updates", I think I recognise that from a blog post from Brent Ozar which he published on April 1st...