Blocking updates seems useful for blocking malicious and helpful updates. I wonder which camp the majority of updates fall into.
If you did want to go this route, a simple fix would be to have the write enable line gated by a hardware one-shot timer (think like a 555 timer) triggered by a physical button on the front (and the button would also reboot the router).
The firmware update sequence would go like: Router prompts user to update using button -> user presses update button -> router reboots to clear malicious software -> when the router comes back up, the write enable gate remains open for $n minutes (and maybe there's a GPIO that can hold the gate open if it is already open) -> router performs software update.
The problem is that there's pretty much no way to do this without adding a $1-2 to the BOM, and no manufacturer of (pro|con)sumer routers will do that.
Edit: Or do what stacktrust wrote and just have a toggle switch (update/secure).
Consumer grade routers often have automatic updates these days.
Some motherboards offer a physical jumper for firmware updates, including x86 PC Engines APU2 coreboot router.
A read-only partition can bootstrap recovery from cloud, if the main firmware or config is damaged.
Some updates are possible with live kernel patching of the memory-resident OS, which can also be used by malware.