If it’s not a category enforced race then the organiser still needs to configure ZwiftPower separately to DQ riders over the limit, which some of them do and others don’t.
The first race I did after dropping back into D, I joined without really looking at the details (only the course and distance) and assumed it had cat enforcement as most races did nowadays. I only realised it must not have been once riding, given how quick some of the riders were (one was doing B numbers and a handful were Cs). However they all got DQ’d in ZwiftPower afterwards, so that clearly still can happen.
As it turns out, between those over the limits, those without HRMs and those not actually registered on ZP at all, there was only one rider listed in D at the end - me! A win’s a win I guess.