In practice it hasn't really been much of a manageability problem at any of the (reasonably large) companies whose servers I've maintained. There are perhaps five or six mission-critical packages that need to be kept up, and since we only support two target distributions, the order of complexity is quite small.

The key is to define your constraints clearly and not to deviate from them unless you have to.