The risk is that a bug in a new version might cause the OTA check to stop working. I assume first of all that the OTA code; either on-line checking or client initiated (e.g. via server.handleClient(); in the loop) is well-tested and stable.
So the first strategy is to test any new version in a local dev environment to ensure that the new version can still perform its OTA before doing a real OTA to a target.
The second strategy when I have an accessible button and am feeling paranoid is to sense the button on start up and use a flag to disable/skip all other functionality in the setup and loop other than the OTA itself.