Are you using the t-mobile app? Maybe uninstall it, if so. Next, on your home network you can block the HTTPS requests that your phone makes to check for profile updates. I don’t recall that domain name (it has to be a domain name and not an IP due to the use of HTTPS for those checks, which Apple requires) but you can probably figure it out from your pihole. You’ll still get updates over cellular.

I agree 100% that it should be opt-out (if not opt-in). I suspect however that the problem with overwriting your settings is as likely a bug as intentional. This area of software is buggy as heck.