I can't imagine the expletives that'll come out of my mouth the day I'm running late for a meeting and my car won't start because its in the middle of an update.
You don't update anything if it works and it's not connected to internet.
If it works and is connected to internet, then disconnect it from internet if possible.
For the rest, delay updates for long enough without having heard complaints that there's sufficient confidence on the update not breaking anything.
Come back to me when there's a punitive liability model for OTA updates. If the garage manages to break something during, that's on the garage, not me. It should be the same for OTA updates: the company pushing the update should be liable for any failure and for providing replacement transportation if they manage to break my car with an update.