They have remote root access to the vehicle. Even if they didn’t, they can push an update specific to your vehicle that then drives you off a cliff at a designated time.
Says Tesla's software, which can be changed or can be lying.
IIRC, one self-described ex-Telsa firmware guy recounted on some story where he or his team scripted running some SSH commands on a bunch of vehicles to fix some bug they pushed that wouldn't have been able to fix otherwise.
Tesla disabled his ethernet port in the vehicle, automatically downgraded the firmware to another version which didn't have references, and then blocked the car from getting future upgrades.
-User mode updates- may not be automatic - that does nothing to prove that Tesla cannot update a vehicle without interaction.
Tesla owns the entire stack. They choose when to update, it just happens to be easier and more pleasant to give people the choice. Given that you can trigger the update via the mobile app, there is clearly support for remote updates. And if you as an owner can do it, then Tesla certainly can, even if they choose not to.