The update processes used are protected to reasonably prevent them being compromised, including the development of the update delivery system. The Interpretation Document: the delivery mechanism cannot be manipulated to deliver unauthorised updates, with security by design in the creation of the update system (ISO 24089 4.3.1.3 cyber security aspects, 6.3.1.1; the CSMS and R155 as references).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.