Soon after launch this will be a non issue. I have a mechanism in the background that will work like this (well close to this)
Vault_manager gets downloads from SAFE (so crypto signed, etc.)
Manager starts a sacrificial extra vault
sacrificial vault is monitored over a randomised period
if the sacrificial vaults rank is at least equal to changes in line with existing vaults then the update is considered good
This is the basic approach, so the network will not only protect against us going rogue or bad, but also us providing code that reduces effectiveness in any way (the ultimate Qa if you like).
I am not going deep into detail here, but you can see when you consider this, of course the network is autonomous, it can be programmed to live 
(in fact our fallback udp/tcp port is 5483 (live if you look on your phone). This is the sort of thing truly autonomous systems can actually do. So as I said previously everything the current Internet can do is fine, but what we can now consider beyond that is another level of innovation I cannot begin to imagine, Things like updates though become very much more interesting indeed, imagine write a new node (or computation) and try and launch it, the network will tell you if its any good (its partners will de-rank bad behaviour, failures etc.)
I hope you can get a glimpse of where we can go with this 