"Note: We enabled the availability of iOS 18.7.7 for more devices on April 1, 2026, so users with Automatic Updates turned on can automatically receive important security protections from web attacks called DarkSword. The fixes associated with the DarkSword exploit first shipped in 2025."
https://support.apple.com/en-us/126793
I speculate withholding security updates from iOS 26 compatible devices still on iOS 18 to force people to update didn't work out due to Liquid Glass resistance.