Google started rolling out its November patches yesterday, but the Pixel 2 XL was conspicuously absent until later in the day. Even when the OTA began rolling out, Google had not posted the files on its developer site. Now, those files are live and ready for sideloading. The Pixel 2 also has some new builds in addition to the ones from yesterday.
The OTA files can be used to update from the last official build, and your bootloader can remain locked. The system images can be flashed over just about anything, but you need an unlocked bootloader. Remember, there are Verizon-specific and standard builds. The 2 XL builds and the new Pixel 2 builds are all labeled "EMR," which isn't a term Google has used before. Possibly something related to a maintenance release?
These updates still do not have the KRACK fixes. Contrary to Google's earlier statements, not all November updates have the necessary patches for the WiFi bug. Only a patch level of November 6th or later will have KRACK fixes, and these are all still November 5th.
We've gotten confirmation from the head of Android security Adrian Ludwig (see the comments on this post) that Google hasn't rolled out the KRACK patches on any Pixel devices yet. It's the 11-6 patch level that has KRACK fixes, and nothing is running that yet. Google is going to make changes to the bulletin so this is more clear.