I’ve used all of these deployment patterns (really release patterns), and strongly prefer feature flagging everything with a layer of permission for user-facing changes as well.