2
My approach is conservative. I don't trust anyone else's code (or even mine, for that matter).
I would first update a module on a test site, and do some checking to see if it works ok and doesn't mess up anything else.
Then I would update the module on my production site, after backing up the site first (database and files).
I would only use an "update all modules" function if I had checked it out first on a test site, and I would still do a full backup first.
P.S. There's been some discussion at dev.xoops.org about enhancing XOOPS to make updating easier, but that's still in the concept phase.