You mean like on almost every laptop or phone sold today with their OTA update support? Whether Apple installs the updates before or after you first start the device doesn't change the risk.
Maybe you don't install any updates over the entire device lifetime? Okay but what if the firmware runs a keylogger? You always need to put a ton of trust into the company.
You're starting to read things into my comment that I very much didn't put in, but for the sake of argument sure, let me strengthen my statement a bit.
People should have agency over which software gets installed on the devices they own. This starts at the moment they buy the device.
So a device installing software while it is in the custody of the shop, sure that's fine. However merely having the capability to install software without physical access or any interaction from the owner of the device is already a threat.
Perhaps i over-interpreted. If I came on too strong my apologies.
This seems to me like a solution driven by Apple switching to ocean based shipping. I’d be really surprised if a mechanism like this would work after activation.