"Direct/unknown" applies anywhere where there’s no specific referral data.
What does "direct/unknown" mean in the referrers list?
Generally speaking, this means things like email newsletters (since it’s not a web page) – but over the last several years, this has come to include a large amount of search traffic that’s masked for security, a large amount of mobile traffic (particularly from inside apps), and a lot of “https -> http” traffic, where referral data is dropped for (legacy) security reasons.