In reply to mark k..

It is in the end an halting problem. A code can not reliably decide for itself if it will successfully run or not by the laws of computer science, and it has to run to figure that. At that point DB changes had been made and there should be a mechanism to rollback changes.

If the plugin itself can not run at that point obviously it can not do the role back of data. Running different versions from a different source do not solve the problem that once DB changes were done there is no trivial way to get back to the previous data configuraion and the plugins will have to include a conversion code from any version to any other version data format, which makes it not realistic as it is too much work for no real gain (you should run the latest version of the plugin, right? sooner or later it will break your site if you don't update)

core can help by doing an automatic backup before upgrades, but in the end it is the responsibility of site owner not to buy into this stupid "automatic update" and do their own backup before upgrading (or even better test on a test server first).

But then, when you manage 40 sites for peanuts you obviously do not have the time to properly do anything and you just cross your fingers and go with the fast way, so you get into a position of trusting code you never paid for and don't have any support agreement for it.