You would only need to reboot if the kernel got updated. Otherwise just restart the affected services. And kernel updates can be made faster with kexec so you

You would only need to reboot if the kernel got updated. Otherwise just restart the affected services. And kernel updates can be made faster with kexec so you don't have to reinitialize the hardware. The flashing procedure itself could also be made interruption-free with dual flash, which most sytems have anyway to avoid bricking the system. It would take some effort to make it fast, but I think the update interruption could be brought down to the second-range. You'd still lose NAT state but that would only affect long-lasting sessions like SSH.