It works similarly to Android and iOS. The system partition is read-only, and each new system update is applied as a new system partition image. All user apps are kept separate from the system and are sandboxed.

I believe the "atomic" action is updating the kernel and all the base packages together such that either the whole thing succeeds or the existing system is unchanged. If the system update is atomic, you cannot be stuck in a partially updated state with new versions of some packages and previous versions of others. Naturally something like that lends itself to making rollbacks easier if it does break, much easier than trying to undo an update on a more traditional distro where they do the update in place.