The user_data argument populates some static data which software in your EC2 instance can read, but what then happens based on that data is entirely decided by the piece of software that read the data.
For most general-use AMIs, the software that reads the user-data content runs only on system boot. It takes whatever actions it’s going to take based on the user-data content and then exits. Changing the user-data content after that would therefore not achieve anything, because the software in your instances doesn’t know that it should read the data again and take further actions.
Because of that, EC2 doesn’t allow changing the user-data content for an instance that’s already running. The closest possibility is to stop the instance, change the user-data content, and then start it again. The instance will retain ownership of all of its associated network interfaces and EBS block devices while stopped – unlike if you’d destroyed the instance altogether – but the operating system will still be stopped and then started again and so the software that runs on boot to interpret the user-data will run again.
In modern versions of the hashicorp/aws provider, this pattern of temporarily stopping the instance while changing its user-data is the default behavior. There is no more graceful way to update the user-data, and that’s a constraint of the underlying EC2 platform, not of Terraform or its AWS provider.