[The first bit here is mostly to acknowledge the mistake I made in my original answer:] If you don't want to use autologin at all, check systemctl status autologin. If it is indeed in use:
sudo systemctl mask autologin
This links the service to /dev/null so even if it is enabled it will do nothing. However: I have this on at least one of my Pi's, but I do not remember why, and I notice that systemctl mask whatever.service will create this symlink even if "whatever.service" does not exist, and there is no autologin.service in /lib/systemd, which is where all system service files are, enabled or not. So this is probably a red herring of mine.
You can enable and disable login both for the console and the GUI with raspi-config. WRT the console, what it does is write an autologin.conf to /etc/systemd/system/[email protected].
The getty service starts getty instances (see man getty) on the
console ttys.
Following up on that, I learned something new about systemd; this is from man 5 systemd.unit:
Along with a unit file foo.service, a "drop-in" directory foo.service.d/ may exist. All files with the suffix ".conf" from this directory will be merged in the alphanumeric order and parsed after the main unit file itself has been parsed. This is useful to alter or add configuration settings for a unit, without having to modify unit files.
To disable this, raspi-config simply deletes the file. If you want to permanently ensure it cannot be enabled again, use the same trick as systemctl mask described above (have a look at man ln if you are unfamiliar with what that does):
sudo ln -s /dev/null /etc/systemd/system/[email protected]/autologin.conf
You'll have to delete the original autologin.conf first if it exists. Raspi-config creates that file by redirecting output from cat. If you do that to such an existing symlink, whatever is written to the file just disappears (this likely explains why systemctl mask can be applied to a non-existent service -- this way, if it is ever installed on the system, it should end up masked).
