Yes they could push a firmware update and do whatever they want. Matter is also available over WiFi. Leviton is pushing new firmware to enable Matter on existing devices.
Of course, a power user could block their Matter network from accessing the Internet or update server.