Indeed updates to 128 should not be possible given the current rules, unless a) the user's channel is something other than "esr" or b) the user updated in the brief period yesterday when we did have updates enabled.
Bug 1907540 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Indeed updates to 128 from any OS should not be possible given the current rules, unless a) the user's channel is something other than "esr" or b) the user updated in the brief period yesterday when we did have updates enabled.