What happens if users upgrade to iOS 14.5 but don't update to the version of our app with SKAN/ATT until later? Will that cause a policy violation?

iOS 14.5 actually blocks access to the IDFA at a technical level, which means IDFAs won't be available until/unless the user opts in via the App Tracking Transparency popup. Simultaneously, Branch will make a server-side update to disable other device-level ad attribution methods for iOS 14.5, including for older versions of the Branch SDK.

In other words, you don't need to worry about any compliance issues under Apple's policy, even if your users do not update to the newest version of your app until long after they upgrade to iOS 14.5.