3. If problem domain so more difficult, then making updates not break system should be a breeze. Even if update is broken for some reason, entire High Avaliability world knows to boot from backup for more than 20 years.
4. It already went wrong. And given how wrong it went, I don't trust that people will not "be injured or die" as result of such incompetence.