>I think the always-on IoT thing actually makes sense for life-and-death fields such as automotive/medical.

But critical components should be designed as simple as possible, and be thoroughly tested before device release. Releasing garbage and then patching it OTA doesn't really work for safety critical things. Not so long ago cars didn't have capability to upgrade (firmware on mask ROMs) and I don't think something horribly bad happened.