You can pin actions to a git sha to prevent this but people generally do not. Action authors would prefer their updates be picked up automatically.