There's a fun "#devops is hard" lesson here (#CloudFlare).
1. Because Security, you want to be able to deploy global changes very quickly
2. Because Reliability, you want staged roll-outs that pause or even auto-revert if key metrics get worse
You can't have both 1 and 2 at the same time.
And the temptation to go fast sometimes WILL prove irresistible.
So if you're looking for ways to globally cripple a big cloud, this is the pattern to look for: what is too urgent for staged roll-outs?