From @jonahwilliams

[NullSafetyMode.autodetect is when] the user did not pass a null safety flag
so what we should do is look at the SDK version and entrypoint to determine if it is opted in
but that is not implemented so it falls back to unsound on web

We didn't fall back to unsound. So in #70120 I changed it to actually fall back to the unsound SDK.