@danluu Did it prompt for the update? Or just decide to do it without asking?

I do not want any car with a built-in cellular transceiver.

If the car has multiple computers, they should boot over the CAN bus from a central source. That would ensure you cannot brick the whole car, as only that one source has to have A and B partitions.