config_install_default_config() is not safe to use in hook_update_N()

While writing an upgrade path test for #1846172: Replace the actions API, I ran into a bit of a problem.
system_update_8046() calls config_install_default_config('module', 'node');, which prematurely installs the new config I'm trying to update to.

Also, when doing config entity upgrades, we had to use config() directly, and not use entity_create().
But config_install_default_config() still invokes the storage controllers importCreate(), which is still calls EntityStorageControllerInterface::create() and EntityStorageControllerInterface::save()!

It is called by:
user_update_8011()
system_update_8046()