It's all about a smart synchronization policy
You need a smart synchronization policy that works in tandem with your roll-out approach of your update. The most obvious point in time where the IoT device should sync its version is directly after the update. The rest of the sync schedule is highly dependent on the type of device.
Is it always on and connected via cabled connection where a single sync doesn't cost (a lot) it makes sense to sync pretty periodically to keep your data about the device current.
If the device is somewhere were every bit is costly because you are using expensive satellite connections the sync schedule has to accommodate that circumstance.
Verification of the synchronization
In a sufficiently advanced device (read a price range or operation area that justifies it) each device could be equipped with a client certificate that enables an authenticity check of the synchronization.
Anyways with end customer devices you'll always have devices fall of the radar due to dying batteries, the device falling out of use or simply the customer changing its wireless password and not informing the IoT device. Those might not have to do anything with your update, even if they fall together timing-wise.