Aside from the suggestion of beta testing on human lives, you are assuming that your phase-deployment mechanism always works correctly. Even Google has previously botched phased deployments and slow rollouts.
> Aside from the suggestion of beta testing on human lives
There was no such suggestion. You can do thorough internal beta testing and still not uncover every bug that will surface in production, because encountering every possible scenario that will occur in a complex system following mass deployment is only possible following mass deployment, and it is still worth reducing the impact of those bugs.
> you are assuming that your phase-deployment mechanism always works correctly.
It can work correctly 30% of the time and still be 30% better than not having it, because then a serious problem has to coincide with a failure of the phased deployment in order to have widespread consequences. This is why safety-critical systems are layered, so that you don't need them all to work all of the time as long as having all of them fail at the same time is sufficiently rare.
The thing about systemic risk is that it's systemic. You don't have to wait six months for leaves to fall because when it's spring in North America it's autumn in Australia. One place going without rain for months may be common but every place going without rain for months would be unprecedented.
