Is it possible to update the WSUpgradeOTA(and other) files via OTA? Or can I only do that by directly writing to the device over HCI TX/RX?
Also, is it possible to upgrade from non-secure-OTA to secure-OTA via OTA?
That's exactly the goal of the OTA. You are installing new application over the air. It can be the same application with bug fixed, or it can be completely different application. The old one could be supporting unsecure OTA and the new one can be supporting secure OTA.