Trying a system update on a remote device without an option to access the device if something goes wrong is risky, but if you want to take the risk, you can download the system binaries and send them OTA via CLI
particle flash <deviceName> system-part1-<version>-<platform>.bin
particle flash <deviceName> system-part2-<version>-<platform>.bin
# and for Electron also
particle flash <deviceName> system-part3-<version>-<platform>.bin
But for this to work you need have the device to stay online long enough to consume all system parts.
If your device is part of a Product Creators product, providing a higher target application firmware will cause the product management to upgrade the device automatically.