State is a different problem. Usually programs don't mutate their executables.

Mutable, persistent state is usually put under /var and is user-owned. Package updates should not touch data in there.