I wonder if for critical applications we'll ever go back to just PXE booting images from a central server: just load a barebones kernel and the app you want to run into a dedicated memory segment, mark everything else as NX, and you don't even have to worry about things like viruses and hacks anymore. Run into an issue? Just reboot!
Linux has some immutable OS versions and also btrfs snapshots and booting a specific snapshot from the GRUB bootloader