1) If you had given user option to create BPMN through some UI. I mean In UI you only ask for data, task type but in the background you create BPMN file from it required for you business process.
This way you could have given UI for update with which your users are already familear. Other option is to provide Drools Guvnor and show you process there and then user can edit and update the process.
2) In this case users need to expert in BPMN as you are asking them to chnage task squence. In this case you have to see that data is also proerlly chnaged. What happens if you are using result for second task in thrid task, and you user chnages this task sequence. In this case your process will not work.
If you have task such as review or approve/Reject which are not based on previous data then you can allow your user to chnage the sequence.
Your business users will be able to update the Process in BPMN only if they had expertise to create it.
Additionally I want to wnow if this is for any specific domain and you have created any donaim specific task. May be in this case user has to add minimal data and even if you chnage sequence it does not affect overall process data?