Is it accurate to say that CFR is generally enabled for devices managed by Windows Update for Business, but not for devices managed by WSUS?

I don’t think I fully grasp the distinction between LCU vs. CFR in the context of delivering the Secure Boot update. Is there a Microsoft blog post or documentation that explains how these mechanisms differ and how the Secure Boot update is actually rolled out?