> services: they are specifically designed to be updated and restarted

I write plenty of daemons (you call them "services"). What exactly do I write specifically for them to be able to continue to run when a library is upgraded?

Sorry, I meant things like dependency management among services.

I don't think systemd supports what you are asking but it shouldn't be too hard to write a service that restarts other services if their shared libraries change?

https://github.com/liske/needrestart is quite useful. It even has heuristics for updates to Python code, Java classes...

Nothing. They just keep using the old version of the lib and thus potentially vulnerable.

Yes, but they continue to run while the library is being updated. That's the point. They can get restarted once the update process finishes, which takes a lot less time than be shut down, wait for update, and be started again.

From what I know, Windows doesn't allow a library to be replaced until it's not used by anything, which is more intrusive and is IMO the root cause (though indirect) why people hate updating Windows.