I'm not convinced about that – for one thing, isn't the EPG in the transmitted data rather than on-line data? I agree the catch-up augmentation could be missing though.
It seems quite likely the Internet traffic for firmware updates will be distinguishable from other traffic, and the box might well "phone home" at a regular time each night to check whether there is anything to download, but it would take somebody with a YouView box and the motivation to record and analyse WireShark network captures in order to work it out.