You mean like on almost every laptop or phone sold today with their OTA update support? Whether Apple installs the updates before or after you first start the device doesn't change the risk.

Maybe you don't install any updates over the entire device lifetime? Okay but what if the firmware runs a keylogger? You always need to put a ton of trust into the company.

Well, maybe they had that capability all along, hmm. I guess you trusted that they didn't?

Apple already has the capability to remotely install software on your phone.