The display settings, and/or screen lock settings, along with maybe the accessibility settings.

Also check your security settings inside device administrators, because Google recently put some crapware in there that allows apps to do something with your phone lock and/or password (I removed it, so don't remember what it was).

This is exactly why I do not allow updates to my device.

In my experience, 'security updates' and the like are only Google and providers reclaiming devices that we think that we control.

Settings
Developers options
Automatic system updates
(off)

Also, if you had been running a firewall, you might have been able to discover exactly what app(s) were responsible for the update.

Then you could go about disabling, denying permissions, clearing all data, and/or whatever else can be done with such intrusive crAPPS.