I wouldn't be surprised if both Google and Apple could do whatever they want with our phones remotely. It's just that they usually don't, so we never see it.
From my perspective there shouldn't be a problem for Apple to have the regular updates work as you describe. And also for them to have an alternative method they can use without any user intervention at all. (Which probably very seldom is used.)