I recommended that Drupal 4.7 ship with a Patches directory.  In interviews with administrators we found that it was taking from 20 hours to 40 hours to upgrade Drupal when you factored in absolutely everything including feature  requests, testing, user training etc.  One of the reasons was that so many people had patched Drupal.

By adding a patches directory we encourage people running Drupal sites to keep a set of patches that most likely apply against  security releases easily.   If we did add a patches directory it would make it easier to recommend what John is suggesting.

Kieran