Thanks for responding Matthew, and I can imagine the sense of frustration you're all feeling.

My 2cents:

Any change should be considered dangerous, and be tested first, time weighted to it's level of change. (An internal policy that could be communicated publicly. One that I apply to all my staff)

It would be also good to have data center clusters (preferably a datacenter clusters are sharded among regions) which would allow these changes to happen as necessary. A random cluster being the "first cluster" with a roll back in place if fails, or proceed through to other clusters progressively until all are live.

The sharding should hopefully alleviate any corner of the world taking any massive hit due to degraded performance.