For sure its an issue. Just as an FYI, there are designs (e.g. Demand Peripherals
http://www.demandperipherals.com/) that manage to dispense with the JTAG stuff and refresh their FPGAs all over USB. So in theory, I think such a device could be update in place with no cable movement. Such a sw/firmware update might be encompassed in ROS if it has not been already (report version number etc). Again security raises its thorny head.