That's just not true. I'm in Europe and all of my routers allow me to disable unattended updates and most don't enable it by default.

might be too old, my asus router updated and I could no longer disable updates and you could just look up the relevant law here: EU Cyber Resilience Act (CRA) 2024.

While it doesn't make it mandatory, it does require patching devices in a timely fasion which in other terms: requires forced updates - pushing updated firmware is not enough if you read between the lines.

Even stronger requirements come into effect at the end of 2027.