Can an iOS update be downloaded without consent?

It is possible to have Automatic Updates showing off, but still have Security Response updated automatically. Go to Settings > General > Software Update > Automatic Updates. Here you can choose either iOS updates or Security Response Updates. If you shut off iOS updates, the previous screen will show that Automatic Updates are off, even though the option for Security Responses is on.

It sounds like you have the Automatic Updates off for iOS, but have it on for the Security Responses and the notification you are seeing would be legitimate. It does not have any of the tell tale signs of a phishing attempt. If it did, then you would have an option to cancel and the tone would make it seem more urgent. There is nothing requiring action on your part.

The wording of that message ("Security Response", and "16.5.1 (c)" – why the "(c)"?) is suspicious.

Makes me wonder if it might be a "phishing" notification from a Web site, with a copy of Apple's icon pasted on (in the place where a custom icon would go) to fool you into thinking it is genuine. From other threads, it appears that there has been some of that going on with Web site / Safari notifications on the Mac.

I don't know if the same thing could be going on with the iPhone, but just in case, I would not tap on that notice to open it, and if I did tap it by mistake, I would not enter any information (like passwords, etc.) in whatever place the notification might lead to.

Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

Note that, according to OS X Daily, just installing iOS 16.4 will enable the auto-installation preference on your phone.

https://osxdaily.com/2023/04/04/psa-ios-16-4-enables-auto-installing-software-updates-by-default/

I could be wrong about the wording of the message being suspicious, because that article shows a control labeled "Security Responses & System Files" in the Automatic Updates settings screen. It is possible to enable automatic updates of those while disabling automatic updates for other things.

Absolutely legit and important to install it when available. Read this.

About Rapid Security Responses for iOS, iPadOS, and macOS - Apple Support

All discussion so far re: notifications and installation notwithstanding …

… 16.5.1(c) is a legit Apple update.

I’m glad to be proven wrong.

The “Response” wording and the “(c)” in the version name just looked like things that were.not typical of Apple security updates that I had read about before.

There is nothing wrong with being cautious. I knew about it from reading some other posts in the forum.