Sure, there could be exceptions like parts of security systems that would have to be tested in production because of limitations of data/threat modeling. I'm th

Sure, there could be exceptions like parts of security systems that would have to be tested in production because of limitations of data/threat modeling. I'm thinking mostly end user software, UI's, games, etc. that increasingly ship things expecting to patch it along the way.