Apple did something like this with a billion live OS X/iOS deployments (HFS+ -> APFS). It can be done methodically at scale as other commenters point out, but obviously needs care).
You don’t need to look that far. Many of us here lived through the introduction of NTFS and did live migrations from FAT32 to NTFS in the days of Windows 2000 and Windows XP.
Yea thanks for recalling this. I totally forgot about that because I never trusted Windows upgrade, let alone filesystem conversion. Always backup and clean install. It's Microsoft software after all.
Craig Federighi on some podcast once said they conducted dry-runs of the process in previous iOS updates (presumably building the new APFS filesystem metadata in a file without promoting it to the superblock) and checking its integrity and submitting telemetry data to ensure success.
Apple doesn’t just deploy to the whole world in an instant though.
First it goes to the private beta users, then the public beta users, and then it slowly rolls out globally. Presumably they could slow down the roll out even more for a risky change to monitor it.
Sure, but still whoever wrote the patch had his ass on the line even shipping to a batch of beta users. Remember this is Apple not Google where the dude likely got promoted and left the team right after pressing click :)
I still remember the syntax: convert C: /fs:ntfs