Some 20 years ago I was asked to prepare OS distribution with OTA upgrade capability for some PoS system.
I think I prepared two system partitions and a custom MBR which would alternate the system partition on every start (uses one bit of non-volatile memory to alternate selection of partitions on each boot).
When the system starts, it does self-test. If it fails the self-test it just restarts. If it succeeds -- it writes the result on its partition and then looks at the other partition. If the other partition did not succeed the test, it reports the fact back to HQ and overwrites it with the current system.
The upgrade procedure is extremely simple -- the current system writes to the other partition, then restarts. If the upgrade is interrupted at any point in time, the other system will know it was interrupted and will just restart immediately. In any case, after two restarts we are back to the system that initiated the upgrade and if it checks the other system did not start and self-tested successfully, it can redo the upgrade as many time as we want and you still have a working system.
Could it be done better? Probably it could. It took me one day to think up and implement.
I would think Ford could do it better (Edited: yes, not a Tesla)