Setting up all that for single man project might be a hassle but for any sofware with actual dev team I wouldn't call it hard to do.

I'd worry more about the fact that essentially publishing binary-first means that it ever gets compromised that makes it easier for attacker to smuggle exploit using "this is security update" pretext.