the device is restarted, if the new firmware is working correctly you signal the update process that everything is all right and it sets the new partition as default.
if the device doesn't boot correctly, or your sanity checks don't pass, either you or the watchdog restarts the device and it boot from the known-working partition.
Flashing the firmware of a cheap IoT device remotely OTA is not without risk.
Well, in addition to flashing the incorrect or buggy firmware.
But more widely: you just don't need to flash devices very often.
Moreover OTA is just because that's something we used to be able to do till Tuya shutdown the cloud cutter hack which could do it (which also requires physical access - you have to reboot the device into flashing mode, you can still do it but you can't custom flash anymore OTA on most newer ones).
EDIT: to further clarify, there are no gotchas or anything, you can use your own servers and require the images to be signed or not.