So my confusion is generally it's best practices to keep branches off of these releases and then just apply fixes to that. Even better is if you can keep the meta build around or use a distributed build system so that you can do incremental builds for patches to that release getting the time way down, unless of course you're changing core libraries and have to recompile or re-link everything. It would seem a risk to me security wise that there wasn't a fast way to get patches out to prod per app or fo the os that don't require full blown rebuilds.

I guess I may also not be accounting for the QA process.