found the answer... here learn.microsoft.com/en-us/window...
by design, Dynamic Update packages " include:
-Setup.exe binaries or other files that Setup uses for feature updates
-Updates for the SafeOS (Windows RE)
-Updates to the servicing stack
- latest cumulative (quality) update ****

Assuming this is by design, but curious: why does the latest LCU bypass deferral when bundled with a Feature Update? #Windows11 #Intune #PatchManagement #MSIntune

Is anyone else seeing this? We have Update Rings configured so only Ring 3 devices get LCUs with a 14-day deferral. We released the 23H2 Feature Update as optional — but on Win11 endpoints where users installed it, the July LCU was also applied immediately, even though they’re in Ring 3.

Is the psm1 missing code? I ran the Uninstall-Graph and the helper functions did not work. Dot-sourcing the .ps1 files fixed it:
$PrivateFunctions = Get-ChildItem -Path "$ModuleRoot\Private\*.ps1" -ErrorAction SilentlyContinue
foreach ($file in $PrivateFunctions) {
. $file.FullName
}