Wait? My Lenovo laptop did exactly this. It first encrypted the SSD without telling me, then it updated the bios via windows update (or via Lenovo assistant, but still it was unattended)

Luckily I was using a Microsoft account (usually I don’t because fuck that) so the keys were automatically backupped