They have an unopened/unsetup phone (I would assume this feature gets disabled once the phone is set up) with iOS 16 that they own, and someone with bad intenti

They have an unopened/unsetup phone (I would assume this feature gets disabled once the phone is set up) with iOS 16 that they own, and someone with bad intentions wants to forcibly update it to iOS 17? I mean, technically there is an attack vector there, but it's oddly specific, and since the attacker needs physical access anyways, you've got other problems (i.e. someone got into your home).