Shutdown is an event at the Windows level but at the Access level there is no explicit code for it and no specific event. What happens is (more or less) like this:
Windows detects a shutdown. Inside Windows there is a task list. Every task gets a notification to start shutting down as Windows steps through the task list one at a time to issue that notification. Because at this point the operating system is still time-sharing/time-slicing, each task has the opportunity to shut itself down in an orderly fashion.
It is up to each process, but the PREFERRED action under Windows is that every process steps through its process-local list of connections and file handles and issues a Close operation, one at a time, until each connection and each file is closed - at which time the process self-terminates. This internal situation has a formal name you can look up - "Process Rundown."
For Access, open reports and forms potentially represent open recordsets - which are connections - and those recordsets, like any OTHER connections, must be closed. (That's what Windows commanded it to do...) Therefore, Access tries to close those open objects - again, one closure at a time using the UNLOAD event, which can be canceled. You CAN intercept the closures if there is a special thing to be done - like an UNDO on a "dirty" bound form before you close it. It IS possible to cancel a form closure in the UNLOAD event, which would leave Access with no way to force the issue since it can't close as long as you cancel the unload attempt. UNLOAD precedes CLOSE. If you don't stop it at UNLOAD, the CLOSE definitely WILL occur.
Blocking the UNLOAD event on a form stops the Rundown from completing, thus leaving Access "hanging." If you DO block the Rundown operation, though, Windows has a second action. If your process doesn't shut down on its own after first notification, Windows steps through the task list a second time and issues a DELETE PROCESS against each task. The internal DELETE PROCESS call is "the hammer" and it means you are about to get nailed. This step cannot be ignored as it is done from the Windows Kernel as user SYSTEM - which has ALL repeat ALL privileges. Anything still open WILL (unequivocally) be closed as-is. If that means that an open connection cannot update a DB file (thus leading to corruption), that is exactly what will happen.
You can use the UNLOAD events to cleanly shut down things, but if Windows is shutting down, you have no choice but to comply. You can do some constructive things to preserve what you've got - but you ARE going to shut down.