I encountered this situation in a game as Sumeria, stuck without Iron. I was able to upgrade my War Carts to Knights in the territory of a city-state of which I was suzerain. I was surprised by this, because I was very much aware of my lack of Iron, and so very carefully checked my territory and the territory of that city-state (the only one devoted to me) for any Iron that might be hiding - there was no Iron anywhere and I should not have been able to make the upgrade. I was not able to upgrade the units inside my own territory.
I assume that, to prevent city-states from being stuck with outdated units - and thus rendered effectively defenseless - the game must allow city-states to upgrade units without the prerequisites. This would be an important ability for them, since they have no way to get access to resources not in their territory and they give away all the resources in their territory to their suzerain if they have one. If my assumption is correct, then the bug here is that the game is performing the "can upgrade unit?" check on the player's units that are in a friendly city-state's territory as if they were units of that city-state. I don't recall encountering this situation in previous versions, but I am unsure if I just never encountered the situation or if the bug is genuinely new.
One other point deserves mentioning here, which is that being able to upgrade units without the necessary strategic resource may not be as exploitable as it sounds. I was in a bad war and my War Carts were very outdated, and so I greedily upgraded them all to Knights - and then I discovered that I had fallen into a terrible trap. Without Iron, the Knights were not able to heal, even in the territory of my city-state ally. So, I went from an outdated army to an advanced army to a worthless army in the matter of a few turns. I deserved my fate - since I knew that I should not be able to upgrade my units - but another player could innocently upgrade their units in this way without realizing that they were exploiting a bug, and then end up in a bad situation that they did not deserve.