What our docs say: the firmware changelog says each release has "a .tpu OTA package, an .img recovery image". It doesn't say the .img erases settings.

Fix I propose:

Update the firmware changelog, release notes and site news to say the .tpu is the upgrade path and keeps settings, and the .img is recovery and erases the password, certificate and settings. Small and safe.
Optionally, make the installer keep the settings storage. It's Turing's own tool (turing-machines/BMC-Installer), so that means forking it or opening a PR upstream. I'd hold it until DingoDogz confirms how they upgrade.