> how much of the whole system you can fit in your head at once.

It's a consistent issue that's brought up... the majority of bugs are found in large releases. The smaller the release, the less likely you'll create a bug (this is where you get some methodologies moving away from waterfall).

I wonder if the future of security practices will just be "deliver small pieces of functionality / changes"