Orbi software change without notice

You seem not to understand how this works. The Orbi, like many other routers, and smart devices, generally, automatically checks for and installs updates. But the Orbi is sending a request to the Netgear servers and asking whether it has the current firmware version. Netgear is NOT remotely logging in and installing it. Many other home routers do this, too, because there is a known issue where users buy a router, configure it, and then never check for updates, leaving them vulnerable to attacks, malware, botnets, etc.

While it's great that you manually check for updates weekly, many users don't. But even checking weekly means potentialy being vulnerable for nearly an entire week. If you check on Sundays, and then Netgear published an update on Monday for some critical vulnerability, you wouldn't have it patched until the following Sunday, which is better than many, but still not as good as checking daily.