Thanks for your replies. I’ve cheched my update settings - and it is set to ask for confirmation before update. As I wrote originally, I did get a question whether to perform the update or not, and I confirmed. The download probably started automatically on a random basis (my raspi runs 24/7, but kodi typically only once per week).
Thus I assume, that everything is fine. I just wanted to ensure that no security risks have been exposed maybe due to the recent kodi.tv security breach - afterwards I’m a little bit more paranoic w. r. t. kodi than before.
Regards, Michael