Far be it from me to tell automakers how to roll out software but I would expect them to have relatively slow and gradual rollouts, segmented by region and environment (e.g., Phoenix might be first while downtown London might be last).

That process itself could still break. (Unlikely though it may be)

Tesla certainly does it this way today. This is also the norm for IoT that I'm aware of. Nobody wants fleet-wide flag days anyway.