We use a small bootloader that does the A/B switching. The bootloader is normally not reflashed.
The big trick is to flash and directly boot into the new firmware but keep the default pointing to the old firmware. Only after test and verification that the firmware is not broken, we send a command to the bootloader to switch to the new firmware after power on.
Note on stm hardware you got sometimes hardware bootloader’s that simplify things. E.g. you can flash using CAN etc.
We shut down the ros stack and have external tooling for firmware flashes. This is mostly due to the fact that we do not update often. If we would update often it would be a special mode in the ros stack.