I believe Tails is able to update itself when it's a LiveCD[1]. I guess it's still not perfect (you need to run the older, less secure version of itself to update itself), but it's better than nothing.

[1] https://tails.boum.org/doc/first_steps/upgrade/index.en.html...