husoski
The control panel code has the ability to write to the website's directory and subdirectories, so it's possible. It's highly unlikely that a tested update would do that on just one site--to the point where I'd suspect deliberate tampering rather than an undetected software error if such an event occurred.
If you're asking whether it's a good idea to back up your site before doing something, the answer to that question is always "yes."