I'm wondering when BPs need to upgrade to a new version of EOSIO, what is the process? When they're actively producing and upgrading to new version takes time.
just an example: while running active node they can establish new node with upgraded software and after it's completely ready just switch IP in DNS. done.
anyway they can even do upgrade on the same system during a time window after they finished last block and wait for the next turn. BPs make several blocks at a time, so they mostly wait until all other BPs make their work. It's should be enough time to stop one nodeos server and run new one. But it's way more dangerous i would say.
In front of the node producing blocks can be running one or more front-end nodes, so from outside world you will not even mention that main producing node was switched to other server. This main node is isolated from outside world and talk only to front-end nodes. This way it is protected from ddos attacks.