Musk ended any and all speculation Saturday, writing, “Using Starlink, a civilian commercial service, for offensive drone strikes to kill people has never been allowed, nor should it be. Starshield, a different system, is controlled by the US government. What they decide to do is up to them.”
Amazing how quickly people forget... This isn't a new restriction or requirement for Starlink. Back at the beginning of the war, when Ukraine first started to use Starlink, their connections were cut off for this same exact reason. Regular Starlink terminals were being sent and used for military operations (which is against the Starlink TOS). After the issues back then, they setup a system for Ukraine to use the Starshield network instead.
Starshield is the network SpaceX setup for the US military. I don't know if SpaceX has these as a different physical set of satellites, or just something like a traffic prioritization system or virtual network spanning the regular satellites, but it is a separate system intended for this exact use case.
It sounds to me like for whatever reason, at least some of the equipment Ukraine was using was on the regular Starlink network instead of Starshield like it should have been, and SpaceX corrected whatever mistake allowed that. Which is a reasonable enough explanation to be legitimate, there's not really a way for us to know if it's a lie, but it is completely plausible. Obviously the complete lack of any sort of advance notification or communication is bullshit, but not exactly unexpected nowadays in modern tech either. It seems like just doing things and dealing with whatever comsequences arise afterwards is the standard now.
The number of companies that don't provide any notice of potentially breaking service changes is by no means limited to SpaceX, or even Silicon Valley companies and the tech startup culture mentality. Several of the vendors I work with don't give us any advance notice about changes they think are trivial (like moving a service to a new domain apparently), despite them exclusively working in a heavily regulated and constantly targeted field where extremely limited external network access is a requirement.