I kinda assume the dealer does this as part of any service they do. Either that, or they update some other way. My software notices went away when I had my service done, even though I’ve opted out of everything (and verified again after).

WiFi is, err, still OTA, although it does answer the eSIM question. I assume the truly concerned/paranoid wouldn't want to connect to WiFi either, since presumably telemetry / tracking metadata could be uploaded at that time too.