The first fallacy in this is that (as I understand it) you only think about probabilities, while in fact it's about probability (of something bad happening) tim

The first fallacy in this is that (as I understand it) you only think about probabilities, while in fact it's about probability (of something bad happening) times the cost of that bad thing. Clearly, a chance for a bug losing you 300$ is much less of a problem than a chance for a bug killing 300 people. The second thing is that a software update may render previous knowledge useless. Just because the old software ran successfully on 100k nodes, it might still be the case that 2 out of 1000 new versions fail, so then you have 0.2% failure rate. That doesn't mean you should take out all 100k nodes but it means you might want to stop the 1k nodes in accordance with the principles laid out above. Finally, I am not even sure why this is a yes/no question. How about: You're allowed to use the plane but you cannot rely on a defense of "the FAA said it was ok" if something happens, so talk to your insurance before.