On top of this (or maybe under it) they have a layer with rollout tiers for Tesla owned cars, cars of employees who opt in for early updates, and customer cars. Probably more than just this. And then with all that they roll it out over time, so we're not all getting the update the same hour, but generally it starts with a trickle the first week and then becomes a flood of users getting a given update over the course of the following week or two.
If you're not on WiFi you might get the "Update Available" notice in the UI first, and then when you get to WiFi it downloads it. But it doesn't wait, if you don't see that notice and it has WiFi, it just downloads it.
Also Tesla says that if conditions warrant, it will download the update even when there is no WiFi. But I think it waits a while to try to opportunistically get on WiFi if it can, to reduce load on the LTE network it uses. If your car never connects to WiFi (which is up to you to do) then it will download, if it can, over LTE if the update is high enough priority.
There are probably silent updates as well as another commenter indicated. Don't know about those but it makes sense.
Rebooting the infotainment screen while driving is no big deal. The car drives just fine without it, and so do I.
Save for small numbers of cars explicitly ordered off-menu with that feature removed, or has been hiding under the rock for six months, they keep the VIN, the connection, and rotating ssh keys to log into any instances of cars of their current models that have ever delivered, and it's not like there are trillion Teslas on the road.
You usually have to be in range of wifi to download updates, afaik.