I realized I've been running a whole bunch of my own smaller projects that way for several years now and I absolutely love it, and now default to it for everything I build
For high stakes systems an alternative I've used that gives much of the benefits while avoiding any risk is Continous Deployment to a staging environment - that way every change is instantly available for manual testing but there's still a deliberate "go live" moment with an extra human in the loop
@simon we go commit, deploy to stage, automated smoke tests, deploy to production for most of our sites.
We have one that has a really long deploy time that might break things when the site is under heavy load. For this we make use of the circle ci manual approval feature, but that's mostly to prevent accidental deploys rather than for QA