And all non-free operating systems can push updates to users. And the free ones can at least hope that you install them yourself.
Microsoft: Proven since XP that they can install updates on user's PCs without their mechanism (one time they pushed one to fix broken Windows update). Can be targeted at single users.
iOS: Appstore/Services stuff in the background. Can be targeted at single users.
Google: Playstore/Services stuff in the background. Can be targeted at single users.
Redhat/Canonical: Probably harder to target a single users, depending on which mirror they use and if the mirror hoster cooperates. But patriot act should be enough to force them to sign and upload a package, possibly for all users.
There are also more stores that may target users. Steam, Epic, possibly snap and flatpak. Other than the large package repos it is easier to target users (and avoid security researchers getting their hands on the malware).
I'd trust LUKS on some distribution with high ideals to be harder to infiltrate, but the Linux large corporations are probably not protecting you.