Modify Application without changing files

This really just depends on how the application is written, but you can usually extend the provided classes in separate files if you want to avoid having your changes overwritten.

Honestly, I usually pull updates into a separate location and use a diff tool to merge changes into my application, so I at least have an idea of which files changed in the update. Bonfire is very good at keeping its code separate from application code (and does manage to keep most of the CodeIgniter code separate from itself), but I still don't let anything into my application without checking it very carefully.

Bonfire

Practical CodeIgniter 3
CodeIgniter Testing Guide