Conditional Access policies changed client app condition setting - we didn't do it

Question

We have x number of conditional access policies. Yesterday we find that all of them have been configured with the 'Client apps (Preview)' condition. The following configurations were made: 'Browser', 'Mobile apps and desktop clients: Modern authentication clients'.
The reason we found out, was because compromised users with a high risk flag still had successful sign-ins, even though they should have been stopped by our conditional policy for high risk users. But because 'Other clients' were not configured, the compromised accounts had free passage with basic auth protocols - in this case authenticated SMTP.
I found the same Client app setting on all of our policies. Not good.

I did some digging around, and found the following article: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#client-apps. In the Client apps (preview) section I can see that Microsoft - at some point - has decided that it is no longer a toggle on/off for the client app setting, but that the setting would default to Browser and modern auth, BUT not for existing policies - as I read it.

However, my suspicion, since we have not activated this setting for any of our policies, is that other changes we have made, have provoked that activation of the client app setting and set the default values.

Anyone found the same or can provide insight into this?