Ask HN: Best practices for OTA updates of IoT devices?

They say there's no such thing as an internet of things, only an internet of unsecured linux boxes.

And indeed, I'm terrified to think how many throwaway IoT devices get put out into the world with years of battery life, and no practical means for updating firmware.

So, I am wondering what recommendations, best practices, tools, etc the community uses to support (and secure) remote, OTA updates for IOT devices. For Linux based SBCs I imagine there's more options, but I curious as well about simpler microcontroller systems.