Does this mean that malware can redirect all my calls by installing an esim with no user interaction?

>The downloadSubscription method requires android.Manifest.permission.WRITE_EMBEDDED_SUBSCRIPTIONS

It's not mentioned but that permission is only available to system apps.