For myself, I'm comfortable with some form of A/B partition update (assuming the problem of distribution and verification is solved elsewhere) however at the very least you still have to patch or script u-boot (or your bootloader of choice) to make it smart enough to try booting the primary partition and also have some sort of canary file it can check on the next boot to validate that the partition booted successfully and e.g. made it all the way to the target runlevel. And if that check fails fall back to the secondary partition or some recovery image.
Embedded firmware updates - especially for M2M devices that are not necessarily user-facing - are sort of like changing the engine of your car while driving down the highway. It's a very tricky thing to get right. Plus if something goes wrong, it's not like you can just SSH into your server or kill that cloud instance and start a new one :)
[1] https://github.com/fhunleth/fwup [2] https://snapcraft.io/