I work for Flagsmith these days, but formerly I was in charge of managing a lot of Trust and Safety related concerns for Clubhouse. This involved deleting a lot of records to appease regulators and creating custom features to handle stuff like CSAM and we used a lot of feature flags there to keep systems safe in case of an event.

The most important architectural decision that we made was pushing some of the feature flagging into the software layer. So, for example, every task had a module name and a task name that together would form the feature flag name. So out of the box any task could be disabled without adding further code. Combined with other good practices it went a long way. Another good option is to enable local evaluation mode[0] which allows a balance between keeping your feature flags up to date while avoiding API calls frequently.

[0] As an aside, I've worked on the implementation of local evaluation mode for one of our clients (I think Python?) at Flagsmith.