yes, warden modules can be updated on the fly during game play without the need for a game restart, if that happens and we detect a change on our end our auth servers go down, and everyone who is online is kicked off until we can analyse the changes that where made. (the entire time we've been doing this with wow and now with d3 this hasn't happened yet) normally, yes they do like to wait and update with patches that gives us time to figure out whats been changed and if we need to change what we are doing on our end to prevent detection then we do it before the new build of the bot client is released. we take a look at everything and we have been doing it for years and that's accumulates into a lot of experience to make sure our customers accounts are safe when using our products.
now, in the past, and with other products blizzard has been known to wait a week or so after a patch to flag as many accounts as possible for purging all at once, most of the time they wait. and its not on a patch day.