It works basically the same with an extra step -- the images have both an image checksum (think CRC32/SHA1/MD5 hash), and a post-install on device checksum; most devices with nvram and roms work the same. (think cisco or juniper router, firewall, etc.)
Personally I think a USB method is safer than FOTA, since the cable method uses a piece of software on the host PC that can be updated if a bug is discovered (remember the infamous E70 bricking NSU firmware not too long ago?). There have already been numerous NSU updates released, who know how many bugs they've fixed (besides adding new handset support).
With a FOTA, you're reliant upon the internal firmware's upgrading code to be correct and not fail; and what if it does? I think your disaster recovery abilities are greater with a cable solution, since if you can at least power it on to the bootloader, you have a slim chance of reviving it. A FOTA upgrade gone wrong, well... you have to plug it into a cable and hope as well!