RFC 9111 allows a cache to invent a freshness lifetime when a response carries no max-age and no Expires, provided its status is cacheable by default, and the widely implemented heuristic is a fraction of the time since Last-Modified, commonly ten percent. A file last modified thirty days ago and served with no caching headers can therefore be held for around three days by a browser or CDN that nobody configured to cache anything.
This is the mechanism behind an asset that keeps serving an old version after a deploy even though caching was never configured. The statuses cacheable by default include 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501, so an error page can stick too. Set an explicit Cache-Control on every response, even if it is only no-cache, instead of relying on the absence of headers to mean the absence of caching.