I work for https://anthropos.io/ and we currently use stretch lite on pi3b as our core os. We have been investigating the use of Fedora IoT as a replacement given some of the advantages that lib-ostree promises.
Further to this, if there is a problem, currently we have the ability to ssh to the hubs and administer ( sudo x y z etc ). However in the Fedora, most of the filesystem is protected, which is good. However is it possible to “check out” the current filesystem to allow some modification, then at a future point either “revert” or “stash” the changes to put the hub back inline. The purpose here is to allow an emergency change to a specific device without having to re-package rpms etc if required.