How to save Order Status Message in Craft Commerce using frontend form
Updating an order from the front end would not be possible unless the user has update/manage order permissions. 

As for the message it is simply a message post param that you send along with the status ID.