If it works for me it works for everyone.
You never patch or upgrade immutable infrastructure. You just replace what you've got with a new VM or container. Containers being preferred because they can be started & stopped near instantaneously and there's nothing like a virtual BIOS that could have different configurations like with VMs.
You don't stand up a VM or container then "log in to configure it". Once the VM is "up" that's it. You're done. At that point you just need to point your load balancers/DNS at the new stuff then take down the old stuff.
One interesting aspect of immutable infrastructure such as this is that it is completely incompatible with loads of existing security policies and what would have been considered "best practices" just a few years ago. For example, you might have a security policy that states that everything must be scanned within 30 days for malware/out-of-date packages/whatever. Yet with immutable infrastructure your hosts or containers may only be up for a few days before being replaced!
So when your security team freaks out because none of your hosts/containers are showing up in their systems you'll have a lot of explaining to do =D
"We need to scan your hosts so we can ensure that you're installing security patches."
"We don't do that."
"You don't install security patches?!?"
"Yeah, well, you see..."
Trust me when I say that trying to explain how it all works and why it's more secure than old school deployments is not easy!