You can update the whole base image. Vanilla OS and SteamOS have an A/B partition that holds the currently-in-use image and can also hold a to-be-used image.

Updating works by adding the to-be-used image, setting a configuration option that tells the system to boot that one, and on the next boot it'll check if the new one is bootable, then either boot it and mark it as working, or boot into the old one and display an error about how out wasn't able to boot into the new one.

There's smart things going on like maybe hard linking files that didn't change between the two images and therefore saving space and copying time.

The result is that you never have a broken system, but you can still frequently update the base image.