Definitely, but this is not completely new territory. Mercedes can remotely update these days as well. Not sure about the other telematic systems, but it's all definitely going this way.

It's probably got an infinitesimal surface area. At least, it better. More importantly, the servers Tesla uses to do the updating better be equally secure.

As far as we know, it is. The update process takes place over a Car<->Tesla VPN, so owners have no visibility into the software update process at all.