For what it is worth, my TV once received a firmware update without being connected to the Internet. It seems there is a facility to multiplex firmware updates into the DVB-T signal, and my TV notified me once it had finished receiving an update intended for that particular model.

It's not clear how useful this would be for espionage, since it would be difficult to target, require cooperation of the broadcaster, and required user interaction to apply the update.