Going forward, I do not think that a timelock is necessary. All a timelock does is give a potential warning period before changes take place. While this sounds great for untrustworthy founders, ours is KYC'd. He is a US citizen and has legal incentive to not rug, since money crimes are not treated lightly in the US.
However, not having a timelock does have a certain stigma to new investors who may not understand the safuness of our particular situation, so I propose a 4 hour timelock. That way, updates can still happen same day, at least.
I think that's to our benefit.