Writing the request body onto the record is the shortest correct-looking code in the file. It handles every field the client sends, it needs no changes when a column is added, and it is exactly one loop.
It also writes the fields nobody meant to expose. The route in this build declares that a customer may change status and nothing else; the handler stopped reading that declaration.
PATCH /orders/1001One field the route allows, one it does not. Watch which fields each build actually wrote.