I don't mean to be a tin foil hat, but I have to ask: How do you know? Do you work at Apple, with this exact thing?

From my perspective there shouldn't be a problem for Apple to have the regular updates work as you describe. And also for them to have an alternative method they can use without any user intervention at all. (Which probably very seldom is used.)