That’s not necessarily a lenovo specific thing, windows can update bios if enabled (has been enabled by default of every modern windows device I own). When vendors push a new bios to the update catalog it’s going to get automatically installed by default. Look for a setting in the security panel of the bios to turn this off, can’t remember exactly what it’s called.