When you update the SMCP, the operator patches the resources owned by this SMCP. If the patch operation is rejected by the Kubernetes API, the operator deletes the resource and tries to re-create it. If the create operation fails just like the patch did, the control plane deployment is broken.

For example, when you update the SMCP to set memory requests for the istio-ingressgateway Deployment, the patch of this Deployment may fail if the requests are higher than the limits. The operator then deletes the Deployment and tries to recreate it, but this also fails. The SMCP's status is PausingUpdate, and the istio-ingressgateway Deployment is missing. 

More info: https://github.com/maistra/istio/issues/514

Also: the SMCP status should show this as an error.