Earlier quoted context omitted.
This is default on iOS and on many Android versions. It's often configurable, but e.g. carrier policy or local vendors can enforce it. To have updates automatically install overnight is the maximally desirable scenario - waiting for user approval usually result in open vulnerabilities, and if you interact with a prompt you are by definition using your device and it is therefore a much worse time than while you're asl…
I hate overnight updates because a dialed one means I have no alarm and will be hours late for work. And yes, this has actually happened to me at least twice.
I've had that happen a few times and the alarms went off on time but they used the default alarm tune instead of the one I had selected, presumably that data was still encrypted.