When you say "I do" do you mean you create different patch versions of your software, with each combination of security fixes and feature updates that can be chosen? Or that you create feature flags that the end user can select?
Either way, I'm skeptical. When you reach 30 feature flags, or 30 selectable updates, you reach more than 1 billion permutations. User 1 wants A but not B and C, User 2 wants A and B and C, and so on. There is NO way you can produce that many patches, or adequately test that many feature flags.
Even Microsoft doesn't have the bandwidth to produce and test that many permutations, and they have many, many more than 30 choices that users would have to pick from.