@Lawrence Finch: delivering the update from the apple server to the iPhone has two points to intervene: a) server is not allowed to send, or b) target is not allowed to receive.
In case a) it is apple that does not allow it; in case b) it is the device itself (the iPhone) that does not allow to receive it over mobile data directly, and is forced by apple to receive it over WiFi. So as it is the device it is also apple that does not allow it.
The carrier only transports the data – and in both cases it is the iPhone that is requesting the data and sending a send-update-command to the apple server. In case of mobile data it is the iPhone that communicates directly with the apple server; in case of Wifi it is also the iPhone that communicates with the apple server – but the signal does not go directly to the apple server but passes first over WiFi to the PC and through USB-cable back to the iPhone and then over mobile data to the apple server.
The carrier does not know or see what (kind of) data he is transporting. He just makes the connection between the two devices (in both cases the apple server and the iPhone) and transports the data from source to target. Arrived in the iPhone it is either directly used by the iPhone (what apple does not allow) or it is transferred to the PC over USB by the iPhone and then sent over WiFi by the PC. For the carrier the iPhone has always the same IP (by connecting to mobile data) with and without WiFi behind. What happens behind (through USB or WiFi) is not in competence of the carrier and he does not know about it.
Again: it is apple that does not allo the server to deliver the update or the iPhone that does not allow to receive the update when the iPhone asks for it connecting directly over mobile data. It is the device – the iPhone – that has the restriction to not allow iOS updates over mobile data directly and only allows to update when the update comes to the iPhone over WiFi. The carrier is not involved in that restriction apple has imposed – otherwise the carrier would not allow to transfer the update from the update server to the device even over USB and WiFi. Also with "tunneling" it is the iPhone (itself) that asks for the update at the apple server – not the PC.