Large edits because now it is clear that OP is asking about devices which only work as a TLS client...
If this is only for client devices than you don't need to update the certificate on the device since there is no certificate on the device. The certificate is on the server (which you need to update) and is checked against the root-CA on the client device. With this root-CA it will accept all certificates issued by this CA, even future certificates. Which means you depend on the same CA issuing certificates within the life time of the device. You might still need a secure way to update the firmware in case yet another buggy TLS stack happened or regulations require the use of better cryptography within the 10+ years time frame.
Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).
And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.
Will it only be the servers's certificate I need to replace and not the root CA on the device?
The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.