For the initial period where the Parachain isn’t completely decentralized, the following way could be used: https://github.com/paritytech/polkadot/pull/5451
If a Parachain is owned by some enterprise, they would probably never set this lock and could use this forever.
In general I thought about some sort of recovery mode for Parachains. Something that is living inside the Parachain runtime. Some very easy code path that could be used to only upgrade a Parachain. However, I don’t know if it is worth to create something like this. The biggest problem would also be the authorization to enter this mode.
Nevertheless, I like this solution the most 