One anecdote I remember was when the release of iPhone OS 1.1 broke jailbreak and I was on the IRC channel: one of the tricks found was to downgrade to 1.0.2, jailbreak the phone, symlink the `/root/Media` directory (reachable through iTunes) to `/` which was preserved during an upgrade, then do a firmware update and have access to rootfs then.

(Yep, it was called iPhone OS back then not iOS.)