Blocking network access by a specific app at the OS level would be the way to achieve this.

I don't believe iOS currently has this ability (all network, not just cellular).

Android has solutions like NetGuard.

But you can make updates manual instead of automatic, that’s something.

The issue with this in practice is that it collapses to one of (a) never take updates ever again or (b) risk that any update changes privacy behavior.

Given that it's impossible for a user to vet each update's content effectively.

I agree about a) but b) does not make sense to me, otherwise you cannot instal the app in the first place. I think that a quick internet search about the apps privacy is sufficient for b), definitely better than automatic updates. And it does not have to happen for every release.