To put it simply, this may not even be something they can do legally. For instance, when the mach E came out they were having serious electrical issues. The electric battery has it's own junction box. So much current was flowing through the contacts that they ended up fusing themselves open or closed. That basically disabled the vehicle. It was fixed with an OTA update. The update works through the same antennas and network you're talking about. If a vehicle can't receive an OTA and it affects the security of the vehicle/driver or poses a danger on public roads? Might be out of compliance with NHTSA or other authorities of similar spec in other countries.
https://www.nhtsa.gov/technology-innovation/vehicle-cybersecurity