how would these offline devices get patched?

They're not offline, theyre just not directly connected. Instead, they're on an in-house network which relays the info back over VPN, or can only be connected to specific addresses over VPN.

The only reason I could think of is the firmware is not performing writes the way the OS expects them to.

I thought this was a buffered-writes issue, where (perhaps based on the filesystem?) the OS may have buffered some of the disk operations in memory and by asking it to unmount you can ensure that everything gets flushed to the drive. Not sure how that would result in ruining/wiping the drive though.

Exactly this.

You can ruin entire filesystem, because not only file blocks are cached, but filesystem blocks too.

If you still do not want to eject the drive beforehand, turn on Optimize for quick removal option (should be default for flash drives now). You will lose write cache though (the write performance will be drastically worse).

It ruins the filesystem if you're in the middle of writing important metadata to the filesystem that can't be done atomically.

This is not an issue for modern filesystems, but most USB drives are formatted with FAT, which has no journaling or other defences against such issues. You could minimize the risk by doing synchronous writes to the drive, but that'd also incur a _very_ big performance penalty.

If you are writing the FAT, you could really screw things up