Hi Jack,
Keep in mind that moving security using an xpo and models can have a side effect. When your deployment strategy is to move a tested model-store from a staging or acceptance environment, there might be some differences in element ID's between intermediate moved objects and the model store. This can cause the setup to be a bit crippled when the model store replaces the element ID's.
Further: Security can also possibly work without CIL compilation, but I'm not 100% sure. But incremental for sure will be correcting all intermediate changes. If you have multiple AOS machines, note that the CIL will be updated on other machines when you restart them.