Eh, you don't typically have a lock mechanism for the filesystem equivalent to that of a database.
Who's to say something like this doesn't happen:
- snapshot fs
- op/system adjust firewall rules
- "you" install updates
- you rollback
- firewall rules is now missing patches
Don't get me wrong zfs is great - but it doesn't come with magical transactions.