The WP auto-updates is enabled, but the Security Overview still shows that it's disabled

If you go to the Automatic Updates module > WordPress Components > and you have "Disable All" option unchecked...

... but the Security Overview > Plugins, Themes, WordPress Core section still shows that the auto core updates is disabled:

or, if you enable any of the WordPress Core Updates options i.e. select Minor Version Only...

... but the Security Overview section still shows that this is disabled, that means that there must be either a plugin or theme that's affecting this setting for you.

Shield tries to filter the settings, but other settings/plugins can override this.

It could also be affected by PHP defines in your wp-config.php or theme's functions.php. For example, you may need to configure your wp-config.php file by changing core updates from 'false' to 'true'.

You may also want to read this for background:
https://codex.wordpress.org/Configuring_Automatic_Background_Updates

Also, you could test disabling plugins 1 at a time and looking at the notices on the site to see if it changes. Before this, however, you could vet your PHP files (mentioned above) to see whether there are settings in there affecting the site.