It's a trade-off. With OTA updates you increase your attack surface, but you make it more likely that the device is updated if needed.