Answering my own question here. There is a way to partial update the list of relations, which avoids the necessity for a full update using entityService.findOne followed by entityService.update.
await strapi.entityService.update('api::vod.vod', vodId, {
data: {
tags: {
connect: [tag]
}
}
})
connect is part of the REST API, but it also applies to entityService. This single request avoids the potential non-atomic operation problem when making multiple requests.