I think there's value to having base separate from pkg, too. The way we ran FreeBSD at the two companies I worked where it was used heavily was to manage base and other things separately.
For base updates, we'd usually shut down services, install kernel and userland, and reboot --- I know this isn't the proper order, but most of the time the new userland is compatible enough to reboot (and you can usually power cycle if that doesn't work out). For updates where rebooting would be hard this way, we'd do it the right way, but then you need to add an extra reboot after installing userland, or restart all the services from base. If needed, we'd install the compat packages after the reboot. We would not update ports/pkg/etc at the same time; old binaries are expected to continue to work on a new system (and generally do). In house binaries are either compiled on the system they run, or centrally on a machine (or chroot/jail) running the oldest release on the fleet.
Generally,
When you need to upgrade software not from base, because of security updates or new features or ennui, you do that isolated from base changes. The only complication here is if you haven't updated base recently enough, pkg may provide binaries you can't run, and ports may provide software you can't compile (this one takes longer).
We would generally only update base for exceptional releases, or when it became hard to update non-base software on older releases. However, new machine installs would get the most recent release we had tested.