@glen ,
Thanks for your question and I really appreciate the other feedback you've given us (on GitHub and here).
While I'm not going to go into the details of the cloud upgrade process, we don't just swap out the installation; there's some other things that happen to ensure upgrades are robust.
We've outlined the downtime expectations here so that it's transparent for everyone and they can choose options that work for them.
I'd also point out that you control the upgrade timing and if you upgrade every single major release (we average about 10/year) that is approximately 50 minutes of downtime, which is 99.99% uptime (that's a ball park, of course, assuming no other downtime and no major database changes that make the upgrade longer).
Finally, I'll pass on your feedback to the engineering team.