The concept of a custodian is not something the IC itself knows - the spec does not even contain the word ‘custodian.’ Since this is a concept that’s entirely defined within canisters, it all depends on the implementation. I’m not sure a canister can be its own controller and self-update, but with a proxy canister (say you’re custodian of A and tell A to upgrade, A sends this command over to B. B is a controller of A, and upgrades A’s code) this would 100% be possible.