I'm sorry, but no. No, most manufacturers update processes aren't actually secure in any meaningful way. Tesla's OTA process seems to use (I've not checked it myself) web standards, encryption, and signatures to verify that the OTA update is correct. The "Physical ethernet cable" that is used by traditional manufacturers can be done by any hobo on the street, in pretty much the same time. It's really only a matter of time before a script-kiddie-ready device that you plug-in and starts the car shows up; There's no security, no signature verification, etc. on the traditional manufacturers updates.

"do Teslas apply OTA updates while the car is underway"

Even your cellphone doesn't update when it's 'under way', what makes you wonder a moving automobile will? If you hazard a guess as to how OTA's are applied to automobiles, I would guess it'll be in Parked, plugged in, and prompted to update by pressing an "Accept & Update" button.

Is that true though? I mean, in my mind OTA makes it a given that the firmware is going to be fully signed and the channel will be fully authenticated. Whereas if a dealer is installing it, they could dismiss concerns with "we trust our service technicians." Seems the latter opens the door to a lot of social engineering possibilities.

But I was responding to a claim of the update being "poorly tested", not insecure. That's orthogonal to it being over the air. A poorly tested update delivered through a service center can also brick your car.

No, of course it does not apply the update while under way. When there's a firmware update available you get a nice big dialog box telling you so and button that says "would you like install tonight at [3 AM]". You can change the time or even cancel the update.

Furthermore, the message tells you it won't install unless the car is plugged in or has a certain level of charge.