I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logic is still working.

Add to that the danger of supply-chain attacks where you don't even want automatic updates.