Another part of the difficulty with updating servers is that updates are rather opaque. My own software on any given server is maybe 0.1% of all the software ru

Another part of the difficulty with updating servers is that updates are rather opaque. My own software on any given server is maybe 0.1% of all the software running on it (if even that). The other 99.9% is someone else's code: the operating system, the software runtime, the libraries, etc. So one doesn't really have a lot of insight into what is about to happen to the server without running a duplicate setup, which as you point out is pretty difficult to get right. I'm sure NASA has much more visibility into all the software that is running on their spacecraft.