Avoid involuntary data pushing to iCloud during updates I run iCloud on iOS/macOS with only "Contacts" (and iMessage) enabled, because I don't want other data copied out of my device.

However, it seems that every time I upgrade iOS/macOS (and possibly when logging out/in of iCloud), that all other iCloud settings are forcibly enabled without my consent.

And you don't notice this until the device is up and running again, and then probably a lot of data has already been copied to iCloud before you manage to turn it off.

How can I make sure no data is copied to iCloud except what I have expressly chosen myself? Will it suffice to disable Wi-Fi before updates, since (I think) iCloud doesn't sync over Cellular Data.

Please provide step-by-step instructions for both iOS and macOS that are watertight.
This is a bug that affected the update to iOS 10.3. Apple has resolved this issue with iOS 10.3.1.

See also Apple Warns iCloud Users Some Disabled Services Were Accidentally Re-enabled in iOS 10.3

iCloud sync settings are not supposed to change after an iOS update. In the case of iOS 10.3 this was due to a bug.

To answer your question: You don't need to change any settings to prevent iOS to enable any iCloud sync settings with 10.3.1 and higher. Older iOS releases (10.2.1 and 10.3) can not be updated to any more.