The publishers can do it via uploading beta branches, but there's also a way to tell the Steam client to fetch old versions independently of that. I remember it coming up specifically with Skyrim, because updates broke a lot of modded environments, and it takes a long time for a lot of mods to be updated (during which time people couldn't play their modded installs).

searches

https://steamcommunity.com/app/489830/discussions/0/4032473829603430509/

The download_depot Steam console command.

The above link is about Skyrim, but also links to a non-Skyrim-specific guide that talks about how to obtain manifest IDs for versions of other games.

But, yeah. It's really not how Steam's intended to be used, and I imagine that hypothetically, one day, it could stop working.

There are also IIRC some ways to block Steam from updating individual games, but again, not intended functionality.

searches

https://steamcommunity.com/discussions/forum/0/3205995441631274440/

If you specifically want control over game updates for some game, then GOG can be a major benefit for that.

One concern I have is that games can be purchased

Oxygen Not Included, for example, was purchased by Tencent, which added data-mining. Fortunately, in that case, Tencent was open about what they were doing, and allowed players to opt out

if they let Tencent log data about them, they could "earn" various in-game rewards. But I could imagine less-pleasant malware being attached to games after someone purchases IP rights to them and just pushes it out. Can't do that with GOG, since there's no channel intrinsically available to a game publisher to push updates out (unless the game has that built-in to itself).