I had this sitting in the middle of a testnet deployment once, where a proposal path looked fine until the timelock and the execution target were wired a little too loosely, one of those harmless-looking admin calls, and suddenly the thing that was supposed to be a vote was just a delayed key. We ended up moving the privileged actions behind a separate contract with a much uglier interface (my usual custom-ISA instincts were yelling about the compatibility tax the whole time), and the first rollback still managed to wedge the queue for an hour...