Even some decent modern Wi-Fi routers have such protection. There's working and backup partition. If a firmware update fails, it boots using the previous working partition.

This is a better explanation (in this case for Cisco Linksys EA3500):

Like several other Linksys devices, the EA3500 has a dual firmware layout: working and backup partitions. Unless you manually choose which partition by doing a manual uboot/tftp install, firmware flashes occur on the backup partition and the EA3500 shall reboot from the backup partition following from a firmware flash. The backup partition becomes the new working partition when the reboot was successful. The former working partition becomes the new backup partition.

Source: https://openwrt.org/toh/linksys/ea3500