A 1-to-1 association won't be deleted upon module update, but the modeler may throw errors about entity access. These are solved with the "Update security" button in the domain model. You can edit 1-to-1 associations from both sides, so on both sides you can define entity access. This is also why you can't create 1-to-1 associations to entities in the System module, as you have no editing rights there as a developer.