This is what ChromeOS and Android do. At least on Android Pixel phones, there's A and B partitions for each of the boot, system, and vendor partitions. The bootloader tracks whether A or B should be booted. Userspace downloads the updates and writes to the opposite-than-booted partition. On reboot, the bootloader boots the latest partition. Downsize is these partitions are now double the size, so less space for the user partition.