You can deploy an update as usual, no need to rebuild the image.
You can build an image that doesn’t do root-on-tmpfs or anything. It just works like a normal NixOS installation. I do it with this configuration that suppresses some of the installer modules:
{
imports = [
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image.nix"
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
];
disabledModules = [
"profiles/all-hardware.nix"
"profiles/base.nix"
];
}