Personal anecdote: It was circa 1985 that I encountered a similar problem. I hand a hand held barcode scanner that had to upload the collected data via a proprietary serial protocol, for eventual reporting, to a PC.

The customer asked "what happens if I disconnect this right now?" during the upload. It was a corner case I hadn't considered. It only took a few days to make it bulletproof.

---

The authors don't seem to consider the case of very slow or intermittent Internet.

I'd be worried about corruption in the download, and check for that. I'd also make very sure the watchdog hardware was on and the code respected it.

It seems to me you need 3 buffers for the OTA code, not 2. There should be a way to keep the last version that runs for X seconds in addition to any new updates, where X is quite large, perhaps a whole day.