In terms of dependencies, I think notify-send-ng should be optional. Perhaps this becomes a dependency of pt-firmware-updater-notifications which extends base functionality to include desktop notifications?

Of course, it still needs to be easy for someone to see that an update is available and waiting, and know what action to take to initiate the process.

If the same check that is done on each desktop login for the notification is done during SSH login, a print-out of a command to run in order to start the updater can be shown. This is similar to how there is a warning when SSH is enabled with default RPi OS password.