A while back I lost a system because I had it configured with full disk encryption and pam_usb for totp-enhanced logins. A bugged update that I applied via pacman broke PAM and I lost my ability to login. This would have been just annoying and not catastrophic had I not also had FDE and forgotten where I stored my LUKS key.
Lesson learned.
I'd not label it such, but as "critical infrastructure". The problem in your case actually was not in PAM but in pacman. For example, apt and yum/dnf checks whether the checksum of the file being changed is different from the original (provided by the package). In standard configuration, apt asks what to do, dnf just puts the file with .rpmnew extension to prevent these kinds of problems.
pacman's "I don't care, this is the new file and I overwrite what I see" is very dangerous behavior.
Also my problem wasn't really pacman either. It was full disk encryption.
But, after understanding it once, I found the process very intuitive and logical, to be honest.