In 99.99% of the cases you won't have it in your path. cf-upgrade is not meant to be invoked by the user but by cf-agent via a special policy. For the 0.01% of cases where somebody wants to call this by hand, I guess it is safe to assume they know what they are doing. If they don't and use this tool because they found it on their path, they have only themselves to blame.