Pleasantly surprised they have a non-onstar option. Figured it would be 'only available with onstar data plan' or something like that (critical recall updates would have to be free)
OTA software updates don't just go wild and hope for the best.
Every software package has a unique signature called a hash that is generated with a very specific analysis algorithm. No two files would have the same hash if they're not the same file.
So the master file has a hash on record, the endpoint downloads a copy, calculates the hash on the copy, and if it matches the master, ok to proceed. If not, retry download until it does match. It should not be installing while downloading on the fly.
You're more likely to brick a device because of faulty code in the package or power interruption during installation than the OTA transfer process (integrity of data).