Hi Thomas,
yes, you could do it but keeping the "identifiers" in the SCORM manifest file the same as in the previous (current) version, to preserve the past tracking data.
Read more at https://moodle.org/mod/forum/discuss.php?d=364523#p1470191 .
That given said, what could happen to the users' tracking experience during the time required by Moodle to install the new package?
Well, during the update of the files of the newly uploaded package, it could happen that some files could not be available, depending on the time required to explode the SCORM archive into the Moodle files pool. This issue will be mitigated by the browser caching mechanisms for those who already attended the Activity in the recent past.
Shortly: just do it when there are few users attending it .
HTH,
Matteo