> This is a great argument against all OTA devices

Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update.

[0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing

It's a great argument for devices made in the US. We can't trust Chinese tech yet we don't make our own.