Does cell service provider has ability to display ads over other apps?

I came to realize that in rare occasions when using the Android phone, Cell service provider (Mobile Network provider) shows some popup advertisements. Regardless of the app, screen I was in it always mange to draw over the screen. Recently I manged to capture the screen when it does (Se attached image). As I checked all the app's permissions to "Display over other apps" there were nothing other than some phone manufacture related and accessibility related system apps. I find this as an security risk as cell provider can hijack my screen. Also I don't thing this is due to a malware/adware since all the ads are related to cell network and their packages. - My question is how Android eco system enables this kind of facility? - Which mechanism or the loopwhole Cell provider might be using? - Is there anyway to disable this? (other than clicking over unsubscribe link on ad) As you could see in the image, I was checking emails and ad got popped over Edit: - I do have a customer care/help app installed which provided by carrier. However I made sure it doesn't draw over apps. - Device is non-rooted, and never touched the bootloader, so might be locked. - Familiar with adb and fastboot. And adb lists the device with proper permission. However while running adb shell appops query-op --user 0 SYSTEM_ALERT_WINDOW allow | while read line; do echo -e "\nPackage: $line "; appops get $line SYSTEM_ALERT_WINDOW; done gives empty results. - Tried adb shell appops query-op --user 0 SYSTEM_ALERT_WINDOW allow also but empty output