The updates are installed onto a different (and isolated) system image or subvolume. Once the update finishes successfully, you can switch to the new system by rebooting. Again, if the update isn't 100% successful, it will not happen. And because this all occurs on a separate partition (or image), you don't have to worry about it affecting your system's current state.
For an operating system that already enjoys rock-solid security, imagine taking that even further to create an operating system that is almost unbreakable. With immutability, Linux distributions mount the core of the system as read-only, which means the contents of those directories cannot be changed. So, if you were to unwittingly install a piece of malicious software, it would not be able to make changes to directories like /bin, /sbin, /usr, /lib, and /etc. That's some pretty high security there.
