ShaniOS maintains two separate environments. If an update - or anything - goes wrong with one environment, simply reboot and switch to the other.
Most security incidents happen in the gap between knowing what matters and actually implementing security controls ...